sigstore-js: Insufficient Verification of Data Authenticity
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 6 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-345.
Summary
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.1.1, @sigstore/verify derives a transparency-log timestamp from tlogEntries[].integratedTime for bundle v0.2 inclusionProof-only entries even though the inclusion proof path does not cryptographically bind integratedTime, allowing an attacker who can supply an untrusted bundle to influence certificate validity and timestampThreshold verification decisions. This issue is fixed in version 3.1.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| sigstore | sigstore-js | before 3.1.1 | 3.1.1 | Patch available | CNA |
| — | @sigstore/verify (npm) | 3.1.0 to before 3.1.1 | 3.1.1 | Patch available | GHSA-xgjw-pm74-86q4 |
- sigstore-js Vendorsigstore Affected before 3.1.1 Fixed in 3.1.1 Patch available CNA
- @sigstore/verify (npm) Vendor— Affected 3.1.0 to before 3.1.1 Fixed in 3.1.1 Patch available GHSA-xgjw-pm74-86q4
Remediation
- Fix · CNA sigstore-js (sigstore) Fixed in 3.1.1
- Fix · GHSA-xgjw-pm74-86q4 @sigstore/verify (npm) Fixed in 3.1.1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet: Fix deferred |
| Red Hat Satellite 6 | Affected | No fix yet: Fix deferred |
| Self-service automation portal 2 | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-48816
- 2026-10-03 Alias added: GHSA-xgjw-pm74-86q4
References
Other 5
- https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4
- https://github.com/sigstore/sigstore-js/pull/1659
- https://github.com/sigstore/sigstore-js/commit/f074710a91ea9260a9ac2142345634579843a3cd
- https://github.com/sigstore/sigstore-js/releases/tag/%40sigstore%2Fverify%403.1.1
- https://github.com/sigstore/sigstore-js
More sigstore vulnerabilities
- TI-2022-16356 False positive signature verification in cosign CVSS 3.1CRITICAL 9.8
- TI-2026-36084 sigstore-js: `certificateOIDs` verification constraints are silently dropped and never enforced CVSS 3.1HIGH 7.5
- TI-2024-19670 Cosign vulnerable to machine-wide denial of service via malicious artifacts CVSS 3.1HIGH 7.5
- TI-2026-18290 Fulcio vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass CVSS 3.1MEDIUM 5.8
- TI-2024-19669 Cosign vulnerable to system-wide denial of service via malicious attachments CVSS 3.1MEDIUM 5.9
- TI-2026-36028 sigstore-js: DSSE payloadType type-binding failure CVSS 3.1MEDIUM 5.4
Sources
- CVE-2026-48816 · CVE Program
- CVE-2026-48816 · NVD
- FIRST EPSS
- GHSA-xgjw-pm74-86q4 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-48816 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences