Affected Systems
GitHub's commit verification system for GPG/SSH-signed commits. All repositories using signed commits with GitHub's "Verified" badge are potentially affected. The flaw is in GitHub's verification logic, not Git itself.
Exploitation Status
Proof-of-concept demonstrated by researchers. No CVE assigned yet. No evidence of active exploitation in the wild, but the technique is now publicly documented and reproducible by attackers without access to signing keys.
Business Impact
Attackers can forge commits that appear legitimately signed and verified by GitHub, undermining trust in commit signatures. This enables supply chain attacks where malicious code can be injected into repositories while appearing to come from trusted developers. Organizations relying on GitHub's "Verified" badge for code review and CI/CD trust decisions are at risk. The flaw does not require compromising developer signing keys, significantly lowering the attack barrier.
Urgency
🟡 Within a week
Recommended Actions
- Audit CI/CD pipelines to ensure they verify commit signatures locally using Git's native verification (git verify-commit) rather than relying solely on GitHub's UI badge
- Implement additional code review controls that do not depend on commit signature status, including mandatory peer review and branch protection rules
- Monitor GitHub security advisories and apply any patches or configuration changes when GitHub releases a fix for this verification flaw
- Educate development teams that GitHub's 'Verified' badge alone is insufficient proof of commit authenticity until this issue is resolved
- Consider implementing commit hash pinning or additional integrity checks in automated deployment workflows for critical repositories