PT-2026-4316 · Sigstore+1 · Sigstore+1
1Seal
·
Published
2026-01-22
·
Updated
2026-05-18
·
CVE-2026-24137
CVSS v3.1
5.8
Medium
| Vector | AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
sigstore framework versions 1.10.3 and below
Description
The sigstore framework, a common Go library used across sigstore services and clients, contains an issue in the legacy TUF client (
pkg/tuf/client.go). This client supports caching target files to disk by constructing a filesystem path using a cache base directory and a target name from signed target metadata. However, it lacks validation to ensure the resulting path remains within the cache base directory. This can allow a malicious TUF repository to trigger arbitrary file overwriting, limited by the permissions of the calling process. This issue primarily affects clients directly using the TUF client within sigstore/sigstore or older versions of Cosign. Users of the public Sigstore deployment are not affected, as TUF metadata is validated by a quorum of trusted collaborators.Recommendations
Versions prior to 1.10.4: Upgrade to version 1.10.4 or later.
Versions prior to 1.10.4: Disable disk caching for the legacy client by setting the environment variable
SIGSTORE NO CACHE to true.
Versions prior to 1.10.4: Migrate to https://github.com/sigstore/sigstore-go/tree/main/pkg/tuf.Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cosign
Sigstore