CVE-2026-24137: sigstore legacy TUF client allows for arbitrary file writes with target cache path traversal
Summary
The legacy TUF client pkg/tuf/client.go, which supports caching target files to disk, constructs a filesystem path by joining a cache base directory with a target name sourced from signed target metadata, but it does not validate that the resulting path stays within the cache base directory.
Note that this should only affect clients that are directly using the TUF client in sigstore/sigstore or are using an older version of Cosign. As this TUF client implementation is deprecated, users should migrate to https://github.com/sigstore/sigstore-go/tree/main/pkg/tuf as soon as possible.
Note that this does not affect users of the public Sigstore deployment, where TUF metadata is validated by a quorum of trusted collaborators.
Impact
A malicious TUF repository can trigger arbitrary file overwriting, limited to the permissions that the calling process has.
Workarounds
Users can disable disk caching for the legacy client by setting SIGSTORENOCACHE=true in the environment, migrate to https://github.com/sigstore/sigstore-go/tree/main/pkg/tuf, or upgrade to the latest sigstore/sigstore release.
Other sources
sigstore framework is a common go library shared across sigstore services and clients. In versions 1.10.3 and below, the legacy TUF client (pkg/tuf/client.go) supports caching target files to disk. It constructs a filesystem path by joining a cache base directory with a target name sourced from signed target metadata; however, it does not validate that the resulting path stays within the cache base directory. A malicious TUF repository can trigger arbitrary file overwriting, limited to the permissions that the calling process has. Note that this should only affect clients that are directly using the TUF client in sigstore/sigstore or are using an older version of Cosign. Public Sigstore deployment users are unaffected, as TUF metadata is validated by a quorum of trusted collaborators. This issue has been fixed in version 1.10.4. As a workaround, users can disable disk caching for the legacy client by setting SIGSTORENOCACHE=true in the environment, migrate to
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/sigstore/sigstoreto a version that resolves this vulnerability.Fixed in 1.10.4 - Upgrade
Upgrade
sigstore/sigstoreto a version that resolves this vulnerability.Fixed in 1.10.4 - Configuration
Set the SIGSTORE_NO_CACHE environment variable to true to disable disk caching.
sigstore legacy TUF client SIGSTORE_NO_CACHE = true - Compensating control
Migrate from the deprecated legacy TUF client to the sigstore-go TUF client.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24137?
CVE-2026-24137 is classified as a high severity vulnerability due to its potential for arbitrary file writes.
How do I fix CVE-2026-24137?
To fix CVE-2026-24137, upgrade to the sigstore package version 1.10.4 or later.
What is affected by CVE-2026-24137?
CVE-2026-24137 affects the legacy TUF client in the sigstore package versions up to 1.10.3.
What type of vulnerability is CVE-2026-24137?
CVE-2026-24137 is a path traversal vulnerability that allows for arbitrary file writes.
Who is impacted by CVE-2026-24137?
Users of the sigstore legacy TUF client who have not upgraded to version 1.10.4 are at risk from CVE-2026-24137.