CVE-2026-128034: Medium severity gittuf gittuf vulnerability

Q: Who is exposed to this issue?

Repositories using gittuf file protection rules for paths that contain special characters, including non-ASCII characters, are exposed. The affected protection patterns include path-based rules such as file:internal/* when they are expected to cover those files.

Q: What does an attacker need to exploit it?

The attacker needs the ability to modify a file with special characters in its pathname. They can exploit the issue when that file should be protected by a file protection rule but is evaluated against Git's quoted, escaped pathname instead of its raw path.

Q: How can I tell whether a repository may be affected?

Review file protection rules and identify protected files whose pathnames contain special characters, particularly non-ASCII characters. If those files are expected to match raw-path patterns but verification uses Git's default quoted path output, they may be treated as unprotected.

Q: What can be done if upgrading is not immediately possible?

Avoid relying on file protection rules to protect files whose pathnames contain special characters. Rename affected protected files to paths that do not require Git quoting, or apply controls outside these rules to prevent unauthorized changes until upgrading to 0.18.0 or later.

Published Nov 13, 2026

Updated

In gittuf before 0.18.0, verification of file protection rules uses the quoted, escaped pathnames that Git prints by default for files with special characters (for example non-ASCII characters) instead of the raw paths. Such paths do not match patterns like file:internal/, so the files are treated as unprotected, and a user who is not authorized by a file protection rule can change a protected file whose name contains special characters and still pass verification.

Affected Software

1 affected component

gittuf gittuf<0.18.0

Event History

Nov 13, 2026

CVE Published

via NVD·04:18 PM

Data Sourced

via NVD·04:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Repositories using gittuf file protection rules for paths that contain special characters, including non-ASCII characters, are exposed. The affected protection patterns include path-based rules such as file:internal/* when they are expected to cover those files.

What does an attacker need to exploit it?

The attacker needs the ability to modify a file with special characters in its pathname. They can exploit the issue when that file should be protected by a file protection rule but is evaluated against Git's quoted, escaped pathname instead of its raw path.

How can I tell whether a repository may be affected?

Review file protection rules and identify protected files whose pathnames contain special characters, particularly non-ASCII characters. If those files are expected to match raw-path patterns but verification uses Git's default quoted path output, they may be treated as unprotected.

What can be done if upgrading is not immediately possible?

Avoid relying on file protection rules to protect files whose pathnames contain special characters. Rename affected protected files to paths that do not require Git quoting, or apply controls outside these rules to prevent unauthorized changes until upgrading to 0.18.0 or later.

CVE-2026-128034: Medium severity gittuf gittuf vulnerability

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

How can I tell whether a repository may be affected?

What can be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

How can I tell whether a repository may be affected?

What can be done if upgrading is not immediately possible?