CVE-2026-49834

MediumCVSS 5.9

Published: 17/07/2026(UTC)Updated: 30/07/2026(UTC)Translated: 23/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.11%

2th percentile - higher than 2% of all known CVEs

Summary

In the sigstore-go library (versions prior to 1.2.0), there is a vulnerability in verification configuration with multiple Transparency Logs or Signed Certificate Timestamps. When configured with a threshold N>1, the verifier counts witnesses per entry or validation path rather than per log authority, allowing a single compromised log to satisfy multi-log requirements.

Risk Assessment

Bypassing multi-log policy could allow an attacker to forge a signature or certificate, undermining trust in the software supply chain.

Recommendation

Update sigstore-go to version 1.2.0 or later, which contains the fix.

Other vulnerabilities in sigstore-go

CVE-2026-54787Low
In the sigstore-go library prior to version 1.2.1, a bundle signing timestamp is not checked against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate. This allows an attacker holding expired key material to sign accepted bundles.

Original NVD description (English source)

sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.0, a verifier configured with WithTransparencyLog(N>1) or WithSignedCertificateTimestamps(N>1) counts verified witnesses per entry or per validation path rather than per log authority, allowing a single compromised transparency log or CT log to satisfy multi-log threshold requirements and defeat the multi-log policy. This issue is fixed in version 1.2.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS