Read the docs
TI-2026-39593 Aliases CVE-2026-54787GHSA-wqqc-jjcq-vfxm

sigstore-go fails to check signature timestamps against a signing key's validity period

Priority LOW 14CWE-324Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired key material to sign accepted bundles. This issue is fixed in version 1.2.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00134 2nd percentileScored 2026-11-07
Fix Fixed sigstore-go (sigstore): 1.2.1github.com/sigstore/sigstore-go (Go): 1.2.1Red Hat: 4 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
sigstoresigstore-gobefore 1.2.11.2.1Patch availableCNA
—github.com/sigstore/sigstore-go (Go)before 1.2.11.2.1Patch availableGHSA-wqqc-jjcq-vfxm
  • sigstore-go Vendorsigstore Affected before 1.2.1 Fixed in 1.2.1 Patch available CNA
  • github.com/sigstore/sigstore-go (Go) Vendor— Affected before 1.2.1 Fixed in 1.2.1 Patch available GHSA-wqqc-jjcq-vfxm

Remediation

  • Fix · CNA sigstore-go (sigstore) Fixed in 1.2.1
  • Fix · GHSA-wqqc-jjcq-vfxm github.com/sigstore/sigstore-go (Go) Fixed in 1.2.1 Advisory →

Red Hat 4 advisories

  • RHSA-2026:47891 Released 2026-07-29 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images trivy-main@aarch64, trivy-main@src, trivy-main@x86_64
  • RHSA-2026:47889 Released 2026-07-29 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images spire1.14-1.14.7-0.3.hum1@aarch64, spire1.14-1.14.7-0.3.hum1@src, spire1.14-1.14.7-0.3.hum1@x86_64 +6
  • RHSA-2026:44451 Released 2026-07-23 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images cosign-3.1.2-0.2.hum1@aarch64, cosign-3.1.2-0.2.hum1@src, cosign-3.1.2-0.2.hum1@x86_64
Show 1 more Red Hat advisories
  • RHSA-2026:44162 Released 2026-07-23 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images spire1.15-1.15.2-0.3.hum1@aarch64, spire1.15-1.15.2-0.3.hum1@src, spire1.15-1.15.2-0.3.hum1@x86_64 +6

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Hardened ImagesFixed RHSA-2026:44162, RHSA-2026:44451, RHSA-2026:47889, RHSA-2026:47891

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54787
  2. 2026-10-03 Alias added: GHSA-wqqc-jjcq-vfxm

References

Other 5

  • TI-2022-16356 False positive signature verification in cosign CVSS 3.1CRITICAL 9.8
  • TI-2026-36084 sigstore-js: `certificateOIDs` verification constraints are silently dropped and never enforced CVSS 3.1HIGH 7.5
  • TI-2024-19670 Cosign vulnerable to machine-wide denial of service via malicious artifacts CVSS 3.1HIGH 7.5
  • TI-2026-18290 Fulcio vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass CVSS 3.1MEDIUM 5.8
  • TI-2026-36085 sigstore-js: Insufficient Verification of Data Authenticity CVSS 3.1MEDIUM 6.5
  • TI-2024-19669 Cosign vulnerable to system-wide denial of service via malicious attachments CVSS 3.1MEDIUM 5.9
See all 39 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences