TI-2026-32277 Aliases CVE-2026-44309 GHSA-7rmh-48mx-2vwc

gitsign verify accepts signatures over go-git-normalized bytes, enabling trust confusion on malformed commits

MEDIUM 57CWE-295Published 2026-05-15 · Updated 2026-05-15

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: High
Impact type: Spoofing, Security bypass
Confidentiality · integrity · availability: None · High · None
Fix status: Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-295 and CWE-347.

Summary

Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. Prior to 0.16.0, gitsign verify and gitsign verify-tag re-encode commit/tag objects through go-git's EncodeWithoutSignature before checking the signature, instead of verifying against the raw git object bytes. For malformed objects with duplicate tree headers, git-core and go-git parse different trees: git-core uses the first, go-git uses the second. A signature crafted over the go-git-normalized form (second tree) passes gitsign verify while git-core resolves the commit to a completely different tree. This breaks the invariant that a verified signature, the commit semantics git-core presents to users, and the object hash logged in Rekor all refer to the same content. This vulnerability is fixed in 0.16.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.0014 3rd percentileScored 2026-11-07

Fix Partial gitsign (sigstore): 0.16.0github.com/sigstore/gitsign (Go): 0.16.0Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
sigstore	gitsign	before 0.16.0	0.16.0	Patch available	CNA
—	github.com/sigstore/gitsign (Go)	before 0.16.0	0.16.0	Patch available	GHSA-7rmh-48mx-2vwc

gitsign Vendorsigstore Affected before 0.16.0 Fixed in 0.16.0 Patch available CNA
github.com/sigstore/gitsign (Go) Vendor— Affected before 0.16.0 Fixed in 0.16.0 Patch available GHSA-7rmh-48mx-2vwc

Remediation

Fix · CNA gitsign (sigstore) Fixed in 0.16.0
Fix · GHSA-7rmh-48mx-2vwc github.com/sigstore/gitsign (Go) Fixed in 0.16.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Trusted Artifact Signer	Affected	No fix yet: Fix deferred

Timeline

2026-10-02 Threatist record created from CVE-2026-44309
2026-10-03 Alias added: GHSA-7rmh-48mx-2vwc

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-44309

Other 2

TI-2022-16356 False positive signature verification in cosign CVSS 3.1CRITICAL 9.8
TI-2026-36084 sigstore-js: `certificateOIDs` verification constraints are silently dropped and never enforced CVSS 3.1HIGH 7.5
TI-2024-19670 Cosign vulnerable to machine-wide denial of service via malicious artifacts CVSS 3.1HIGH 7.5
TI-2026-18290 Fulcio vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass CVSS 3.1MEDIUM 5.8
TI-2026-36085 sigstore-js: Insufficient Verification of Data Authenticity CVSS 3.1MEDIUM 6.5
TI-2024-19669 Cosign vulnerable to system-wide denial of service via malicious attachments CVSS 3.1MEDIUM 5.9

See all 39 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences