CVE-2026-54787 in sigstore-go
Summary
by MITRE • 08/01/2026
sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired key material to sign accepted bundles. This issue is fixed in version 1.2.1.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/01/2026
The sigstore-go library vulnerability represents a critical flaw in the cryptographic verification process that undermines the security assurances provided by the Sigstore framework. This vulnerability specifically affects versions prior to 1.2.1 and stems from an insufficient validation mechanism that fails to properly enforce timestamp constraints against certificate validity windows. The flaw occurs when dealing with ExpiringKey objects that wrap self-managed long-lived signing keys without associated certificates, creating a window where expired cryptographic material can still be accepted as valid.
The technical implementation issue resides in the bundle verification logic that neglects to cross-reference the signing timestamp against the operational validity period of the wrapping ExpiringKey. This oversight allows attackers with access to expired key material to generate signatures that would otherwise be rejected by proper validation procedures. The vulnerability is particularly concerning because it operates at the core verification layer where trust decisions are made, effectively bypassing the temporal integrity checks that should prevent the use of compromised or expired cryptographic resources.
From an operational perspective, this vulnerability creates a significant risk for systems relying on sigstore-go for code signing and artifact verification. Attackers could potentially exploit this weakness to sign malicious content using expired keys that were previously valid, undermining the entire supply chain security model that Sigstore aims to establish. The impact extends beyond simple signature validation failures to potentially enable supply chain attacks where malicious actors leverage expired but still functional key material to compromise software integrity.
The vulnerability aligns with CWE-330 weakness category related to insufficient entropy and improper validation of cryptographic parameters, while also mapping to ATT&CK technique T1553.006 for credential harvesting and T1553.004 for signed binary proxy execution. Organizations using affected versions face potential compromise of their entire software distribution pipeline, as the vulnerability allows attackers to circumvent time-based key expiration policies that are fundamental to cryptographic security practices.
Mitigation strategies should prioritize immediate upgrade to sigstore-go version 1.2.1 or later, which implements proper timestamp validation against key validity windows. Security teams should also conduct comprehensive audits of existing signing infrastructure to identify any expired keys that may have been used in the past. Additional protective measures include implementing continuous monitoring for unauthorized signing activities, establishing stricter key lifecycle management policies, and ensuring that all verification processes properly enforce temporal constraints on cryptographic material usage to prevent similar vulnerabilities from emerging in other components of the security ecosystem.