TI-2026-18230 Aliases CVE-2026-22703 GHSA-whqx-f9j3-ch6m

Cosign verification accepts any valid Rekor entry under certain conditions

LOW 24CWE-345Published 2026-01-10 · Updated 2026-01-12

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: None · High · None
Fix status: Partial Red Hat: 9 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-345.

Summary

Cosign provides code signing and transparency for containers and binaries. Prior to versions 2.6.2 and 3.0.4, Cosign bundle can be crafted to successfully verify an artifact even if the embedded Rekor entry does not reference the artifact's digest, signature or public key. When verifying a Rekor entry, Cosign verifies the Rekor entry signature, and also compares the artifact's digest, the user's public key from either a Fulcio certificate or provided by the user, and the artifact signature to the Rekor entry contents. Without these comparisons, Cosign would accept any response from Rekor as valid. A malicious actor that has compromised a user's identity or signing key could construct a valid Cosign bundle by including any arbitrary Rekor entry, thus preventing the user from being able to audit the signing event. This issue has been patched in versions 2.6.2 and 3.0.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00106 1st percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Partial cosign (sigstore): 3.0.4, 2.6.2github.com/sigstore/cosign/v3 (Go): 3.0.4+1 more productRed Hat: 9 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
sigstore	cosign	before 3.0.4; before 2.6.2	3.0.4, 2.6.2	Patch available	CNA
—	github.com/sigstore/cosign/v3 (Go)	before 3.0.4	3.0.4	Patch available	GHSA-whqx-f9j3-ch6m
—	github.com/sigstore/cosign/v2 (Go)	before 2.6.2	2.6.2	Patch available	GHSA-whqx-f9j3-ch6m

cosign Vendorsigstore Affected before 3.0.4; before 2.6.2 Fixed in 3.0.4, 2.6.2 Patch available CNA
github.com/sigstore/cosign/v3 (Go) Vendor— Affected before 3.0.4 Fixed in 3.0.4 Patch available GHSA-whqx-f9j3-ch6m
github.com/sigstore/cosign/v2 (Go) Vendor— Affected before 2.6.2 Fixed in 2.6.2 Patch available GHSA-whqx-f9j3-ch6m

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:sigstore:cosign::::::::	before 2.6.2; 3.0.0 to before 3.0.4	Vulnerable	sigstore

cpe:2.3:a:sigstore:cosign:*:*:*:*:*:*:*:* Versions before 2.6.2; 3.0.0 to before 3.0.4 Vulnerable ·sigstore

Remediation

Fix · CNA cosign (sigstore) Fixed in 3.0.4, 2.6.2
Fix · GHSA-whqx-f9j3-ch6m github.com/sigstore/cosign/v3 (Go) Fixed in 3.0.4 Advisory →
Fix · GHSA-whqx-f9j3-ch6m github.com/sigstore/cosign/v2 (Go) Fixed in 2.6.2 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
OpenShift Pipelines	Affected	No fix yet: Fix deferred
OpenShift Serverless	Affected	No fix yet: Fix deferred
Red Hat Advanced Cluster Security 4	Affected	No fix yet: Fix deferred
Red Hat OpenShift Dev Spaces	Affected	No fix yet: Fix deferred
Red Hat Trusted Artifact Signer	Affected	No fix yet: Fix deferred
Red Hat Web Terminal	Affected	No fix yet: Fix deferred
Security Profiles Operator	Affected	No fix yet: Fix deferred
Zero Trust Workload Identity Manager	Affected	No fix yet: Fix deferred
Zero Trust Workload Identity Manager - Tech Preview	Affected	No fix yet: Fix deferred

Timeline

2026-10-02 Threatist record created from CVE-2026-22703
2026-10-03 Alias added: GHSA-whqx-f9j3-ch6m

References

Other 2

TI-2022-16356 False positive signature verification in cosign CVSS 3.1CRITICAL 9.8
TI-2024-19670 Cosign vulnerable to machine-wide denial of service via malicious artifacts CVSS 3.1HIGH 7.5
TI-2024-19669 Cosign vulnerable to system-wide denial of service via malicious attachments CVSS 3.1MEDIUM 5.9
TI-2022-16479 Vulnerabilities with blob verification in sigstore cosign CVSS 3.1MEDIUM 5.5
TI-2023-25220 Possible endless data attack from attacker-controlled registry in cosign CVSS 3.1MEDIUM 5.3
TI-2026-28380 Cosign's verify-blob-attestation reports false positive when payload parsing fails CVSS 3.1MEDIUM 5.3

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences