PT-2026-4316 · Sigstore+1 · Sigstore+1

1Seal

·

Published

2026-01-22

·

Updated

2026-05-18

·

CVE-2026-24137

CVSS v3.1

5.8

Medium

VectorAV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions sigstore framework versions 1.10.3 and below
Description The sigstore framework, a common Go library used across sigstore services and clients, contains an issue in the legacy TUF client (pkg/tuf/client.go). This client supports caching target files to disk by constructing a filesystem path using a cache base directory and a target name from signed target metadata. However, it lacks validation to ensure the resulting path remains within the cache base directory. This can allow a malicious TUF repository to trigger arbitrary file overwriting, limited by the permissions of the calling process. This issue primarily affects clients directly using the TUF client within sigstore/sigstore or older versions of Cosign. Users of the public Sigstore deployment are not affected, as TUF metadata is validated by a quorum of trusted collaborators.
Recommendations Versions prior to 1.10.4: Upgrade to version 1.10.4 or later. Versions prior to 1.10.4: Disable disk caching for the legacy client by setting the environment variable SIGSTORE NO CACHE to true. Versions prior to 1.10.4: Migrate to https://github.com/sigstore/sigstore-go/tree/main/pkg/tuf.

Exploit

Fix

Path traversal

Weakness Enumeration

Related Identifiers

CLEANSTART-2026-GK29346
CLEANSTART-2026-HF07497
CLEANSTART-2026-SH14815
CLEANSTART-2026-WB12909
CLEANSTART-2026-WN01990
CVE-2026-24137
GHSA-FCV2-XGW5-PQXF
GO-2026-4358
OPENSUSE-SU-2026:10230-1
OPENSUSE-SU-2026:10235-1
OPENSUSE-SU-2026:10700-1
OPENSUSE-SU-2026:20386-1
OPENSUSE-SU-2026:20730-1
SUSE-SU-2026:0592-1
SUSE-SU-2026:0757-1
SUSE-SU-2026:0777-1
SUSE-SU-2026:20904-1

Affected Products

Cosign
Sigstore