GHSA-G27R-R6PH-VF5R: Authentication Bypass via Policy Hash Truncation in sequoia-git

Vulnerability ID: GHSA-G27R-R6PH-VF5R

CVSS Score: 1.8

Published: 2026-05-04

A logic error in the caching mechanism of the sequoia-git library prior to version 0.6.0 results in the improper processing of OpenPGP hard revocations. A truncation bug during policy hash calculation creates cache collisions, allowing an attacker with a revoked key to bypass commit authentication if they can trick a maintainer into accepting a specific policy modification.

TL;DR

sequoia-git versions prior to 0.6.0 fail to properly enforce OpenPGP key revocations due to a cache collision bug triggered by a zero-byte policy hash.…