PT-2026-20949 · Sigstore · Cosign
1Seal
·
Published
2026-02-19
·
Updated
2026-04-28
·
CVE-2026-24122
CVSS v3.1
3.7
Low
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Cosign versions 3.0.4 and below
Description
Cosign is a tool that provides code signing and transparency for containers and binaries. A flaw in the certificate validation process allows expired intermediate Certificate Authorities to validate signatures under certain conditions. Specifically, when verifying artifact signatures, Cosign initially verifies the certificate chain using the leaf certificate's "not before" timestamp and subsequently checks the leaf certificate's expiry using a signed timestamp or the current time. The root and all issuing certificates are assumed to be valid during the leaf certificate’s validity. This can occur when an issuing certificate expires before the leaf certificate, but a provided timestamp indicates the issuing certificate should be considered expired. This issue does not affect users of the public Sigstore infrastructure but may impact private deployments with customized PKIs.
Recommendations
Upgrade to version 3.0.5 or later.
Verify the certificate chain independently as a workaround.
Exploit
Fix
Improper Certificate Validation
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cosign