Skip to content
Fencer Intel
high 7.5

CVE-2026-33487 json

goxmldsig has validateSignature Loop Variable Capture Signature Bypass

published 7mo ago modified last mo. also EUVD-2026-16281 , GHSA-479m-364c-43vc , GO-2026-4753

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 25%
public exploits
0
none known

Summary

goxmlsig provides XML Digital Signatures implemented in Go. Prior to version 1.6.0, the `validateSignature` function in `validate.go` goes through the references in the `SignedInfo` block to find one that matches the signed element's ID. In Go versions before 1.22, or when `go.mod` uses an older version, there is a loop variable capture issue. The code takes the address of the loop variable `_ref` instead of its value. As a result, if more than one reference matches the ID or if the loop logic is incorrect, the `ref` pointer will always end up pointing to the last element in the `SignedInfo.References` slice after the loop. goxmlsig version 1.6.0 contains a patch.

Patch / fix

  • go github.com/russellhaering/goxmldsig 1.6.0
  • Red Hat Multicluster Global Hub 1.3.4 1779212259
  • Red Hat Multicluster Global Hub 1.4.5 1779579439
  • Red Hat Multicluster Global Hub 1.6.5 1780167118
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14 1782693386
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15 1777142269
  • Red Hat Red Hat multicluster global hub 1.5.3 1778867753
  • Red Hat Red Hat OpenShift GitOps 1.18 1779116359
  • Red Hat Red Hat OpenShift GitOps 1.19 1779209965
  • govulncheck-vulndb openSUSE Leap 15.6 0.0.20260402T184258-150000.1.158.1

suse advisories SUSE-SU-2026:1205-1

  • govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
  • velociraptor openSUSE Tumbleweed 0.7.0.4.git185.a5708584-2.1

opensuse advisories openSUSE-SU-2026:21483-1openSUSE-SU-2026:11126-1

Is CVE-2026-33487 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-33487 updated cvss 7.5

github.com/russellhaering/goxmldsig: goxmlsig: Integrity bypass due to incorrect XML Digital Signature validation via loop variable capture issue

  • Red Hat Multicluster Global Hub 1.3.4 multicluster-globalhub/multicluster-globalhub-grafana-rhel9 1779212259
    fixed: vendor fix RHSA-2026:22423
  • Red Hat Multicluster Global Hub 1.4.9 multicluster-globalhub/multicluster-globalhub-grafana-rhel9 1779579439
    fixed: vendor fix RHSA-2026:22347
  • Red Hat Multicluster Global Hub 1.5.8 multicluster-globalhub/multicluster-globalhub-grafana-rhel9 1778867753
    fixed: vendor fix RHSA-2026:21769
  • Red Hat Multicluster Global Hub 1.6.6 multicluster-globalhub/multicluster-globalhub-grafana-rhel9 1780167118
    fixed: vendor fix RHSA-2026:23345
  • Red Hat Advanced Cluster Management for Kubernetes 2.14 rhacm2/acm-grafana-rhel9 1782693386
    fixed: vendor fix RHSA-2026:36882
  • Red Hat Advanced Cluster Management for Kubernetes 2.15 rhacm2 1777142269
    fixed: vendor fix RHSA-2026:13548
  • Red Hat OpenShift GitOps 1.18 openshift-gitops-1/dex-rhel8 1779116359
    fixed: vendor fix RHSA-2026:20946
  • Red Hat OpenShift GitOps 1.19 openshift-gitops-1/dex-rhel8 1779209965
    fixed: vendor fix RHSA-2026:20943
show 3 more
  • Red Hat Multicluster Global Hub 1.3.4 multicluster-globalhub/multicluster-globalhub-agent-rhel9 1779210675, multicluster-globalhub/multicluster-globalhub-manager-rhel9 1779210608, multicluster-globalhub/multicluster-globalhub-rhel9-operator 1779209992, multicluster-globalhub/multicluster-globalhub-operator-bundle 1779925031, multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9 1779924243 Red Hat Multicluster Global Hub 1.4.9 multicluster-globalhub/multicluster-globalhub-agent-rhel9 1779838819, multicluster-globalhub/multicluster-globalhub-manager-rhel9 1779839447, multicluster-globalhub/multicluster-globalhub-rhel9-operator 1779887217, multicluster-globalhub/multicluster-globalhub-operator-bundle 1779891163, multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9 1779147132 Red Hat Multicluster Global Hub 1.5.8 multicluster-globalhub/multicluster-globalhub-agent-rhel9 1779828691, multicluster-globalhub/multicluster-globalhub-manager-rhel9 1779828813, multicluster-globalhub/multicluster-globalhub-rhel9-operator 1779828536, multicluster-globalhub/multicluster-globalhub-operator-bundle 1779837290, multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9 1779835152 Red Hat Multicluster Global Hub 1.6.6 multicluster-globalhub/multicluster-globalhub-agent-rhel9 1780320809, multicluster-globalhub/multicluster-globalhub-manager-rhel9 1780321673, multicluster-globalhub/multicluster-globalhub-rhel9-operator 1779839087, multicluster-globalhub/multicluster-globalhub-operator-bundle 1780370487, multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9 1779839762 Red Hat Advanced Cluster Management for Kubernetes 2.14 rhacm2/thanos-rhel9 1783122371, rhacm2/acm-cli-rhel9 1783350872, rhacm2/console-rhel9 1783451729, rhacm2/prometheus-rhel9 1783259161, rhacm2/acm-search-v2-rhel9 1783381100, rhacm2/node-exporter-rhel9 1783327463, +37 more Red Hat Advanced Cluster Management for Kubernetes 2.15 rhacm2 1776395605, rhacm2 1776437108, rhacm2 1776440706, rhacm2 1776440738, rhacm2 1776555620, rhacm2 1776641849, +38 more
    not affected: vulnerable code not present
  • Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-roxctl-rhel8, advanced-cluster-security/rhacs-rhel8-operator, advanced-cluster-security/rhacs-scanner-v4-rhel8
    not affected: vulnerable code not in execute path
  • Red Hat Enterprise Linux 8 grafana, grafana-loki, grafana-mssql, grafana-mysql, grafana-selinux, grafana-graphite, +8 more Red Hat Enterprise Linux 9 grafana, grafana-selinux Red Hat Enterprise Linux 10 grafana Red Hat OpenShift GitOps 1.18 openshift-gitops-1/argocd-rhel8 1779115298, openshift-gitops-1/argocd-rhel9 1779116502, openshift-gitops-1/gitops-rhel8 1779116228, openshift-gitops-1/must-gather-rhel8 1779114978, openshift-gitops-1/argocd-agent-rhel8 1779115163, openshift-gitops-1/argo-rollouts-rhel8 1779116461, +4 more Red Hat OpenShift GitOps 1.19 openshift-gitops-1/argocd-rhel8 1779211724, openshift-gitops-1/argocd-rhel9 1779211476, openshift-gitops-1/gitops-rhel8 1779210473, openshift-gitops-1/must-gather-rhel8 1779209869, openshift-gitops-1/argocd-agent-rhel8 1779210454, openshift-gitops-1/argo-rollouts-rhel8 1779210058, +5 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
7mo ago

Exploit prediction

0.32% chance of exploitation in the next 30 days, higher than 25% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • github.com https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-479m-364c-43vc referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected packages

ecosystem package affected fixed in
go github.com/russellhaering/goxmldsig
<1.6.0
1.6.0

Affected products

  • russellhaering goxmldsig
  • Red Hat Multicluster Global Hub 1.3.4
  • Red Hat Multicluster Global Hub 1.4.5
  • Red Hat Multicluster Global Hub 1.6.5
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.15
  • Red Hat Red Hat multicluster global hub 1.5.3
  • Red Hat Red Hat OpenShift GitOps 1.18
  • Red Hat Red Hat OpenShift GitOps 1.19
  • Red Hat Red Hat Advanced Cluster Security 4
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9

Classification

Weakness
  • CWE-347 Improper Verification of Cryptographic Signature
  • CWE-682 Incorrect Calculation

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.