CVE-2026-54787

sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired key material to sign accepted bundles. This issue is fixed in version 1.2.1.

CVSS v3 3.1 LOW

3.1^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.6 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/sigstore/sigstore-go/commit/4594ab4c779d08be1f4419803a8249188f35ed5f
https://github.com/sigstore/sigstore-go/pull/642
https://github.com/sigstore/sigstore-go/releases/tag/v1.2.1
https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm
https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm

Configurations

No configuration.

History

23 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) sigstore-go es una biblioteca Go para la firma y verificación de Sigstore. Antes de la versión 1.2.1, sigstore-go no verifica una marca de tiempo de firma de paquete contra la ventana de validez de una ExpiringKey que envuelve una clave de firma de larga duración autogestionada sin un certificado, lo que puede permitir a un atacante que posee material de clave caducado firmar paquetes aceptados. Este problema está solucionado en la versión 1.2.1.

Information

Published : 2026-07-31 23:17

Updated : 2026-10-23 23:10

NVD link : CVE-2026-54787

Mitre link : CVE-2026-54787

CVE.ORG link : CVE-2026-54787

JSON object : View

Products Affected

No product.

CWE

CWE-324

Use of a Key Past its Expiration Date

{"id": "CVE-2026-54787", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54787", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-31T23:35:40.966529Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.6}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "sigstore", "product": "sigstore-go", "versions": [{"status": "affected", "version": "< 1.2.1"}]}]}], "published": "2026-07-31T23:17:25.287", "references": [{"url": "https://github.com/sigstore/sigstore-go/commit/4594ab4c779d08be1f4419803a8249188f35ed5f", "source": "security-advisories@github.com"}, {"url": "https://github.com/sigstore/sigstore-go/pull/642", "source": "security-advisories@github.com"}, {"url": "https://github.com/sigstore/sigstore-go/releases/tag/v1.2.1", "source": "security-advisories@github.com"}, {"url": "https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm", "source": "security-advisories@github.com"}, {"url": "https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-324"}]}], "descriptions": [{"lang": "en", "value": "sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired key material to sign accepted bundles. This issue is fixed in version 1.2.1."}, {"lang": "es", "value": "sigstore-go es una biblioteca Go para la firma y verificaci\u00f3n de Sigstore. Antes de la versi\u00f3n 1.2.1, sigstore-go no verifica una marca de tiempo de firma de paquete contra la ventana de validez de una ExpiringKey que envuelve una clave de firma de larga duraci\u00f3n autogestionada sin un certificado, lo que puede permitir a un atacante que posee material de clave caducado firmar paquetes aceptados. Este problema est\u00e1 solucionado en la versi\u00f3n 1.2.1."}], "lastModified": "2026-10-23T23:10:00.157", "sourceIdentifier": "security-advisories@github.com"}