CVE-2026-39395
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Cosign, a tool for signing containers and binaries, erroneously reports 'Verified OK' for attestations with malformed payloads or mismatched predicate types. The flaw exists in versions before 3.0.6 and 2.6.3.
Risk Assessment
An attacker can supply a forged attestation that is accepted as valid, potentially leading to execution of unauthorized software.
Recommendation
Update Cosign to version 3.0.6 or 2.6.3.
Original NVD description (English source)
Cosign provides code signing and transparency for containers and binaries. Prior to 3.0.6 and 2.6.3, cosign verify-blob-attestation may erroneously report a "Verified OK" result for attestations with malformed payloads or mismatched predicate types. For old-format bundles and detached signatures, this was due to a logic flaw in the error handling of the predicate type validation. For new-format bundles, the predicate type validation was bypassed completely. This vulnerability is fixed in 3.0.6 and 2.6.3.