PT-2026-24484 · Unknown · Sigstore-Ruby

Hanazuki · Published 2026-03-10 · Updated 2026-03-11 · CVE-2026-31830

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions sigstore-ruby versions prior to 0.2.3

Description The software does not correctly handle verification failures when the artifact digest does not match the digest in the in-toto attestation subject. Specifically, the Sigstore::Verifier#verify function does not propagate the VerificationFailure returned by verify in toto. This results in successful verification even when the artifact does not match the attested subject, impacting the verification of DSSE bundles containing in-toto statements.

Recommendations Update to version 0.2.3 or later.

Exploit

Fix

Unchecked Return Value

Weakness Enumeration

CWE-252

Related Identifiers

CVE-2026-31830

GHSA-MHG6-2Q2V-9H2C

Affected Products

Sigstore-Ruby

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31830.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/sigstore/CVE-2026-31830.yml · Exploit
• https://github.com/sigstore/sigstore-ruby/security/advisories/GHSA-mhg6-2q2v-9h2c · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mhg6-2q2v-9h2c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31830 · Security Note
• https://osv.dev/vulnerability/CVE-2026-31830 · Vendor Advisory
• https://github.com/sigstore/sigstore-ruby · Note
• https://twitter.com/CVEnew/status/2031504065931133439 · Twitter Post
• https://t.me/CVEtracker/47036 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1rqu37b/resumen_diario_de_vulnerabilidades_11032026 · Reddit Post