CVE-2026-54787

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-54787", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-15T23:23:57.714Z", "datePublished": "2026-07-31T21:58:14.156Z", "dateUpdated": "2026-07-31T23:36:13.441Z"}, "containers": {"cna": {"title": "sigstore-go fails to check signature timestamps against a signing key's validity period", "problemTypes": [{"descriptions": [{"cweId": "CWE-324", "lang": "en", "description": "CWE-324: Use of a Key Past its Expiration Date", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm"}, {"name": "https://github.com/sigstore/sigstore-go/pull/642", "tags": ["x_refsource_MISC"], "url": "https://github.com/sigstore/sigstore-go/pull/642"}, {"name": "https://github.com/sigstore/sigstore-go/commit/4594ab4c779d08be1f4419803a8249188f35ed5f", "tags": ["x_refsource_MISC"], "url": "https://github.com/sigstore/sigstore-go/commit/4594ab4c779d08be1f4419803a8249188f35ed5f"}, {"name": "https://github.com/sigstore/sigstore-go/releases/tag/v1.2.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/sigstore/sigstore-go/releases/tag/v1.2.1"}], "affected": [{"vendor": "sigstore", "product": "sigstore-go", "versions": [{"version": "< 1.2.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-31T21:58:14.156Z"}, "descriptions": [{"lang": "en", "value": "sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired key material to sign accepted bundles. This issue is fixed in version 1.2.1."}], "source": {"advisory": "GHSA-wqqc-jjcq-vfxm", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-31T23:35:40.966529Z", "id": "CVE-2026-54787", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-31T23:36:13.441Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-54787", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-31T23:35:40.966529Z"}}}], "references": [{"url": "https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-31T23:36:08.101Z"}}], "cna": {"title": "sigstore-go fails to check signature timestamps against a signing key's validity period", "source": {"advisory": "GHSA-wqqc-jjcq-vfxm", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "sigstore", "product": "sigstore-go", "versions": [{"status": "affected", "version": "< 1.2.1"}]}], "references": [{"url": "https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm", "name": "https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/sigstore/sigstore-go/pull/642", "name": "https://github.com/sigstore/sigstore-go/pull/642", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/sigstore/sigstore-go/commit/4594ab4c779d08be1f4419803a8249188f35ed5f", "name": "https://github.com/sigstore/sigstore-go/commit/4594ab4c779d08be1f4419803a8249188f35ed5f", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/sigstore/sigstore-go/releases/tag/v1.2.1", "name": "https://github.com/sigstore/sigstore-go/releases/tag/v1.2.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired key material to sign accepted bundles. This issue is fixed in version 1.2.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-324", "description": "CWE-324: Use of a Key Past its Expiration Date"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-31T21:58:14.156Z"}}}, "cveMetadata": {"cveId": "CVE-2026-54787", "state": "PUBLISHED", "dateUpdated": "2026-07-31T23:36:13.441Z", "dateReserved": "2026-06-15T23:23:57.714Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-31T21:58:14.156Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "sigstore-go", "vendor": "sigstore", "versions": [{"status": "affected", "version": "< 1.2.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired key material to sign accepted bundles. This issue is fixed in version 1.2.1."}, {"lang": "es", "value": "sigstore-go es una biblioteca Go para la firma y verificaci\u00f3n de Sigstore. Antes de la versi\u00f3n 1.2.1, sigstore-go no verifica una marca de tiempo de firma de paquete contra la ventana de validez de una ExpiringKey que envuelve una clave de firma de larga duraci\u00f3n autogestionada sin un certificado, lo que puede permitir a un atacante que posee material de clave caducado firmar paquetes aceptados. Este problema est\u00e1 solucionado en la versi\u00f3n 1.2.1."}], "id": "CVE-2026-54787", "lastModified": "2026-10-23T23:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54787", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-31T23:35:40.966529Z", "version": "2.0.3"}}]}, "published": "2026-07-31T23:17:25.287", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/sigstore/sigstore-go/commit/4594ab4c779d08be1f4419803a8249188f35ed5f"}, {"source": "security-advisories@github.com", "url": "https://github.com/sigstore/sigstore-go/pull/642"}, {"source": "security-advisories@github.com", "url": "https://github.com/sigstore/sigstore-go/releases/tag/v1.2.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-324"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2026:47891", "cpe": "cpe:/a:redhat:hummingbird:1", "package": "trivy-main-0.72.0-0.1.3.hum1", "product_name": "Red Hat Hardened Images", "release_date": "2026-07-29T00:00:00Z"}], "bugzilla": {"description": "github.com/sigstore/sigstore-go: sigstore-go: Signature bypass allows acceptance of bundles signed with expired keys", "id": "2509939", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509939"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "status": "verified"}, "cwe": "CWE-347", "details": ["A flaw was found in sigstore-go, a software library used for verifying digital signatures. This vulnerability specifically affects the workflow for self-managed long-lived signing keys that do not use certificates. An attacker who possesses an expired signing key can exploit this by creating and signing software bundles that the system will incorrectly accept as valid. This bypasses the intended security checks, potentially leading to the acceptance of unauthorized or malicious software."], "name": "CVE-2026-54787", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "cosign", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "spire1.14", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "spire1.15", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-07-31T21:58:14Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-54787\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-54787\nhttps://github.com/sigstore/sigstore-go/commit/4594ab4c779d08be1f4419803a8249188f35ed5f\nhttps://github.com/sigstore/sigstore-go/pull/642\nhttps://github.com/sigstore/sigstore-go/releases/tag/v1.2.1\nhttps://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.2.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "sigstore-go", "source": "cna", "vendor": "sigstore"}, "product": "sigstore-go", "vendor": "sigstore"}], "created": "2026-07-31T23:30:17.101115+00:00", "updated": "2026-08-04T22:30:05.164205+00:00", "vendors": ["sigstore", "sigstore$PRODUCT$sigstore-go"]}