CVE-2026-45022: go-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git

Synopsis

This is a cryptographic signature bypass vulnerability in go-git, a pure-Go Git implementation library. An authenticated attacker can craft malformed Git commit or tag objects that go-git parses differently from upstream Git, causing go-git to sign or verify a reconstructed payload that does not match the raw bytes actually stored in the repository. Successful exploitation lets an attacker make a tampered commit appear to carry a valid cryptographic signature, undermining the integrity of signed commit workflows. No upstream fix version has been published yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the affected go-git service over the network to deliver or inject malformed Git objects.

• AuthenticationRequired

  A low-privilege account (PR:L) is sufficient; the attacker does not need administrative credentials, but some form of authenticated access to push or supply objects is necessary.

• Victim interactionNot required

  No user action is needed; go-git processes the malformed object automatically during normal parsing or verification operations.

• Attack complexityDetail

  Exploitation is rated High complexity (AC:H), meaning the attacker must carefully craft a malformed object that triggers the parsing divergence; success is not guaranteed on every attempt and may depend on specific object structure or parser state.

Blast Radius

• An attacker can cause go-git to accept and record a cryptographic signature as valid over a reconstructed commit payload that does not match the raw bytes in the repository.
• Commit or tag metadata displayed to developers (author, message, timestamps) may differ from the object that was actually signed, enabling undetected tampering with repository history.
• Integrity guarantees of signed commit workflows are broken: downstream systems that rely on go-git signature verification to gate deployments or audits may approve malicious or altered commits.
• Confidentiality of stored data is not affected; the impact is limited to integrity of commit signing and verification.