{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-54787", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-15T23:23:57.714Z", "datePublished": "2026-07-31T21:58:14.156Z", "dateUpdated": "2026-07-31T23:36:13.441Z"}, "containers": {"cna": {"title": "sigstore-go fails to check signature timestamps against a signing key's validity period", "problemTypes": [{"descriptions": [{"cweId": "CWE-324", "lang": "en", "description": "CWE-324: Use of a Key Past its Expiration Date", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm"}, {"name": "https://github.com/sigstore/sigstore-go/pull/642", "tags": ["x_refsource_MISC"], "url": "https://github.com/sigstore/sigstore-go/pull/642"}, {"name": "https://github.com/sigstore/sigstore-go/commit/4594ab4c779d08be1f4419803a8249188f35ed5f", "tags": ["x_refsource_MISC"], "url": "https://github.com/sigstore/sigstore-go/commit/4594ab4c779d08be1f4419803a8249188f35ed5f"}, {"name": "https://github.com/sigstore/sigstore-go/releases/tag/v1.2.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/sigstore/sigstore-go/releases/tag/v1.2.1"}], "affected": [{"vendor": "sigstore", "product": "sigstore-go", "versions": [{"version": "< 1.2.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-31T21:58:14.156Z"}, "descriptions": [{"lang": "en", "value": "sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired key material to sign accepted bundles. This issue is fixed in version 1.2.1."}], "source": {"advisory": "GHSA-wqqc-jjcq-vfxm", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-31T23:35:40.966529Z", "id": "CVE-2026-54787", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-31T23:36:13.441Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-54787", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-31T23:35:40.966529Z"}}}], "references": [{"url": "https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-31T23:36:08.101Z"}}], "cna": {"title": "sigstore-go fails to check signature timestamps against a signing key's validity period", "source": {"advisory": "GHSA-wqqc-jjcq-vfxm", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "sigstore", "product": "sigstore-go", "versions": [{"status": "affected", "version": "< 1.2.1"}]}], "references": [{"url": "https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm", "name": "https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/sigstore/sigstore-go/pull/642", "name": "https://github.com/sigstore/sigstore-go/pull/642", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/sigstore/sigstore-go/commit/4594ab4c779d08be1f4419803a8249188f35ed5f", "name": "https://github.com/sigstore/sigstore-go/commit/4594ab4c779d08be1f4419803a8249188f35ed5f", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/sigstore/sigstore-go/releases/tag/v1.2.1", "name": "https://github.com/sigstore/sigstore-go/releases/tag/v1.2.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired key material to sign accepted bundles. This issue is fixed in version 1.2.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-324", "description": "CWE-324: Use of a Key Past its Expiration Date"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-31T21:58:14.156Z"}}}, "cveMetadata": {"cveId": "CVE-2026-54787", "state": "PUBLISHED", "dateUpdated": "2026-07-31T23:36:13.441Z", "dateReserved": "2026-06-15T23:23:57.714Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-31T21:58:14.156Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "sigstore-go", "vendor": "sigstore", "versions": [{"status": "affected", "version": "< 1.2.1"}]}], "source": "[email protected]"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired key material to sign accepted bundles. This issue is fixed in version 1.2.1."}], "id": "CVE-2026-54787", "lastModified": "2026-08-01T00:17:17.040", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 1.4, "source": "[email protected]", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54787", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-31T23:35:40.966529Z", "version": "2.0.3"}}]}, "published": "2026-07-31T23:17:25.287", "references": [{"source": "[email protected]", "url": "https://github.com/sigstore/sigstore-go/commit/4594ab4c779d08be1f4419803a8249188f35ed5f"}, {"source": "[email protected]", "url": "https://github.com/sigstore/sigstore-go/pull/642"}, {"source": "[email protected]", "url": "https://github.com/sigstore/sigstore-go/releases/tag/v1.2.1"}, {"source": "[email protected]", "url": "https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-324"}], "source": "[email protected]", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2026:47891", "cpe": "cpe:/a:redhat:hummingbird:1", "package": "trivy-main-0.72.0-0.1.3.hum1", "product_name": "Red Hat Hardened Images", "release_date": "2026-07-29T00:00:00Z"}], "bugzilla": {"description": "github.com/sigstore/sigstore-go: sigstore-go: Signature bypass allows acceptance of bundles signed with expired keys", "id": "2509939", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509939"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "status": "verified"}, "cwe": "CWE-347", "details": ["A flaw was found in sigstore-go, a software library used for verifying digital signatures. This vulnerability specifically affects the workflow for self-managed long-lived signing keys that do not use certificates. An attacker who possesses an expired signing key can exploit this by creating and signing software bundles that the system will incorrectly accept as valid. This bypasses the intended security checks, potentially leading to the acceptance of unauthorized or malicious software."], "name": "CVE-2026-54787", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "cosign", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "spire1.14", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "spire1.15", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-07-31T21:58:14Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-54787\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-54787\nhttps://github.com/sigstore/sigstore-go/commit/4594ab4c779d08be1f4419803a8249188f35ed5f\nhttps://github.com/sigstore/sigstore-go/pull/642\nhttps://github.com/sigstore/sigstore-go/releases/tag/v1.2.1\nhttps://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.2.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "sigstore-go", "source": "cna", "vendor": "sigstore"}, "product": "sigstore-go", "vendor": "sigstore"}], "created": "2026-07-31T23:30:17.101115+00:00", "updated": "2026-08-04T22:30:05.164205+00:00", "vendors": ["sigstore", "sigstore$PRODUCT$sigstore-go"]}