GHSA-h829-5cg7-6hff gitverify has improper tag signature verification
An attacker can bypass tag signature verification in gitverify by using an unsigned annotated tag, undermining supply chain integrity checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-h829-5cg7-6hff?
GHSA-h829-5cg7-6hff is a vulnerability in github.com/supply-chain-tools/gitverify, published on 24 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
gitverify is still a prototype.
Impact
The bug is related to requireSignedTags which is on by default: an unsigned annotated tag would pass the verification. The commit pointed to by the tag would still have to be signed by a maintainer or a contributor.
Patches
Since the initial commit, fixed in c2c60da05d5c73621d0ce7ea02770bacd79ec8b1 (no semantic versions yet).
Workarounds
No
Which versions are affected by GHSA-h829-5cg7-6hff?
3 open source packages ship an affected version, including github.com/supply-chain-tools/gitverify.
| Package | Affected | Fixed in |
|---|---|---|
github.com/supply-chain-tools/gitverify Go | All versions | 0.0.0-20260421124901-c2c60da05d5c |
github.com/supply-chain-tools/gitverify Go | All versions | 0.0.0-20260421124901-c2c60da05d5c |
github.com/supply-chain-tools/gitverify Go | All versions | 0.0.0-20260421124901-c2c60da05d5c |
How do I fix GHSA-h829-5cg7-6hff?
Upgrade github.com/supply-chain-tools/gitverify to 0.0.0-20260421124901-c2c60da05d5c or later.
Is GHSA-h829-5cg7-6hff being exploited?
There is no known exploitation of GHSA-h829-5cg7-6hff in the wild and no public exploit code.
Sources
Also known as GO-2026-5416.