CVE-2026-54787 in sigstore-go
Riassunto
di MITRE • 01/08/2026
sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired key material to sign accepted bundles. This issue is fixed in version 1.2.1.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.