PT-2026-66873 · Unknown · Sigstore-Go

CVE-2026-54787 · Published 2026-07-31 · Updated 2026-07-31

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions sigstore-go versions prior to 1.2.1

Description The library fails to verify the bundle signing timestamp against the validity window of an ExpiringKey when using a self-managed long-lived signing key without a certificate. This allows an attacker who possesses expired key material to sign bundles that are incorrectly accepted by the validator. This issue specifically affects the long-lived signing key workflow and does not impact standard deployments that utilize a certificate authority.

Recommendations Update to version 1.2.1.

Exploit

Fix

Weakness Enumeration

CWE-324

Related Identifiers

CVE-2026-54787

GHSA-WQQC-JJCQ-VFXM

Affected Products

Sigstore-Go

References · 7

• 🔥 https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-54787 · Security Note
• https://osv.dev/vulnerability/GHSA-wqqc-jjcq-vfxm · Vendor Advisory
• https://github.com/sigstore/sigstore-go/commit/4594ab4c779d08be1f4419803a8249188f35ed5f · Note
• https://github.com/sigstore/sigstore-go/pull/642 · Note
• https://github.com/sigstore/sigstore-go · Note
• https://github.com/sigstore/sigstore-go/releases/tag/v1.2.1 · Note