# CVE-2026-33487: russellhaering goxmldsig signature bypass in validateSignature

Source: https://junglewise.ai/threats/cve-2026-33487-russellhaering-goxmldsig-signature-bypass-in-validatesignature  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-26. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-33487 · Severity: high · CVSS 7.5 · Published 2026-03-26

The goxmldsig library, used for processing XML digital signatures in Go-based applications, contains a flaw that can allow attackers to bypass security checks. By exploiting a coding error in how the library validates signatures, an attacker could modify the content of a signed document without invalidating the signature. This could lead to unauthorized data modification or the bypass of integrity protections in systems that rely on this library for secure communications.

Technologies: [github.com/russellhaering/goxmldsig (Go)](https://junglewise.ai/threats/technologies/github-com-russellhaering-goxmldsig), [Red Hat Multicluster Global Hub](https://junglewise.ai/threats/technologies/multicluster-global-hub). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-33487 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33487 being exploited in the wild.

**How severe is CVE-2026-33487?** High severity, with a CVSS score of 7.5, published 26 March 2026.

**Which products and versions are affected?** github.com/russellhaering/goxmldsig (Go) SEMVER:introduced=0,fixed=1.6.0; Red Hat Multicluster Global Hub 1.3.4, 1.4.5, 1.5.4, 1.6.2.

**Is there a fix for CVE-2026-33487?** Yes. github.com/russellhaering/goxmldsig (Go): upgrade to 1.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-33487 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-33487?** Check whether you run github.com/russellhaering/goxmldsig (Go), Goxmldsig Project Goxmldsig or Red Hat Multicluster Global Hub at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/russellhaering/goxmldsig (Go): upgrade to 1.6.0 or later

  ```sh
  go get github.com/russellhaering/goxmldsig@v1.6.0
  ```


## Technical details

A loop variable capture vulnerability exists in the `validateSignature` function within `validate.go`. When compiled with Go versions prior to 1.22 (or using older `go.mod` settings), the code takes the address of the loop iteration variable `_ref` instead of its value. Because Go reused the same memory address for loop variables in older versions, the `ref` pointer consistently points to the final element in the `SignedInfo.References` slice regardless of which element actually matched the ID. An attacker can exploit this by providing multiple references, allowing them to substitute malicious content for a legitimate signed element. The issue is resolved in version 1.6.0 by using the slice index to reference elements directly.

## Affected products

- russellhaering goxmldsig <= v1.5.0
- Red Hat Advanced Cluster Management for Kubernetes 2.15
- Red Hat OpenShift GitOps 1.18, 1.19
- Red Hat Multicluster Global Hub 1.3.4, 1.4.5, 1.5.4, 1.6.2

## Identifiers

- CVE-2026-33487
- GHSA-479m-364c-43vc
- GO-2026-4753

## Timeline

- 2026-03-18: advisory: GitHub Advisory GHSA-479m-364c-43vc published
- 2026-03-26: disclosed: CVE-2026-33487 published to NVD
- 2026-05-04: patched: Red Hat released security updates for Advanced Cluster Management

## References

- [https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-479m-364c-43vc](https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-479m-364c-43vc)
- [https://access.redhat.com/errata/RHSA-2026:13548](https://access.redhat.com/errata/RHSA-2026:13548)
- [https://access.redhat.com/errata/RHSA-2026:20943](https://access.redhat.com/errata/RHSA-2026:20943)
- [https://access.redhat.com/errata/RHSA-2026:20946](https://access.redhat.com/errata/RHSA-2026:20946)
- [https://access.redhat.com/errata/RHSA-2026:21769](https://access.redhat.com/errata/RHSA-2026:21769)
- [https://access.redhat.com/errata/RHSA-2026:22347](https://access.redhat.com/errata/RHSA-2026:22347)
- [https://access.redhat.com/errata/RHSA-2026:22423](https://access.redhat.com/errata/RHSA-2026:22423)

## Related threats

- [Red Hat Multicluster Global Hub privilege escalation during ManagedClusterMigration](https://junglewise.ai/threats/cve-2026-71577-red-hat-multicluster-global-hub-privilege-escalation-during)
- [Red Hat Multicluster Global Hub authentication bypass in Kafka CloudEvents](https://junglewise.ai/threats/cve-2026-71576-red-hat-multicluster-global-hub-authentication-bypass-in-kafka)
- [Apache Thrift improper certificate validation in TSSLTransportFactory](https://junglewise.ai/threats/cve-2026-43869-apache-thrift-improper-certificate-validation-in)
- [Apache Thrift out-of-bounds read in C++ JSON implementation](https://junglewise.ai/threats/cve-2026-41607-apache-thrift-out-of-bounds-read-in-c-json-implementation)
- [Apache Thrift uncontrolled recursion in c_glib dispatch](https://junglewise.ai/threats/cve-2026-41606-apache-thrift-uncontrolled-recursion-in-c-glib-dispatch)