VYPR
← All advisories
Medium severity4.3NVD Advisory· Published Apr 7, 2026· Updated Jul 24, 2026

CVE-2026-39395

CVE-2026-39395

Description

Cosign provides code signing and transparency for containers and binaries. Prior to 3.0.6 and 2.6.3, cosign verify-blob-attestation may erroneously report a "Verified OK" result for attestations with malformed payloads or mismatched predicate types. For old-format bundles and detached signatures, this was due to a logic flaw in the error handling of the predicate type validation. For new-format bundles, the predicate type validation was bypassed completely. This vulnerability is fixed in 3.0.6 and 2.6.3.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/sigstore/cosignGo
>= 3.0.0, < 3.0.63.0.6
github.com/sigstore/cosignGo
< 2.6.32.6.3

Affected products

169

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.