CVE-2026-54787: sigstore-go fails to check signature timestamps against a signing key's validity period
sigstore-go fails to check signature timestamps against a signing key's validity period
Other sources
sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired key material to sign accepted bundles. This issue is fixed in version 1.2.1.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/sigstore/sigstore-goto a version that resolves this vulnerability.Fixed in 1.2.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.97.0-1 - Upgrade
Upgrade
sigstore-goto a version that resolves this vulnerability.Fixed in 1.2.1Patch sigstore-go-public-key-validity-test.patch
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54787?
The severity of CVE-2026-54787 is low with a score of 3.1.
How do I fix CVE-2026-54787?
To fix CVE-2026-54787, ensure that self-managed long-lived keys are wrapped in an 'ExpiringKey' type to enforce expiration semantics.
What impact does CVE-2026-54787 have on signature verification?
CVE-2026-54787 can lead to improper verification of signatures due to the failure to check timestamps against the signing key's validity period.
Who is affected by CVE-2026-54787?
Those using sigstore-go with self-managed long-lived keys without certificates are affected by CVE-2026-54787.
When was CVE-2026-54787 published?
CVE-2026-54787 was published on July 31, 2026.