Unrated severityOSV Advisory· Published Jul 19, 2026

Debian sigstore-go: sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.…

CVE-2026-49834

Description

sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.0, a verifier configured with WithTransparencyLog(N>1) or WithSignedCertificateTimestamps(N>1) counts verified witnesses per entry or per validation path rather than per log authority, allowing a single compromised transparency log or CT log to satisfy multi-log threshold requirements and defeat the multi-log policy. This issue is fixed in version 1.2.0.

Affected products

137

Sigstore/Sigstore GoOSV2 versions
v1.1.4, v1.1.3, v1.1.2, …+ 1 more
- (no CPE)range: v1.1.4, v1.1.3, v1.1.2, …
- (no CPE)range: <1.2.0
osv-coords135 versions
pkg:apk/chainguard/aactl pkg:apk/chainguard/cloudbeat-9.3 pkg:apk/chainguard/cloudbeat-9.4 pkg:apk/chainguard/cloudbeat-fips-9.3 pkg:apk/chainguard/cloudbeat-fips-9.4 pkg:apk/chainguard/crossplane-1.20 pkg:apk/chainguard/crossplane-2.0 pkg:apk/chainguard/crossplane-2.1 pkg:apk/chainguard/crossplane-2.2 pkg:apk/chainguard/crossplane-2.2-crank pkg:apk/chainguard/crossplane-fips-1.20 pkg:apk/chainguard/crossplane-fips-2.0 pkg:apk/chainguard/crossplane-fips-2.1 pkg:apk/chainguard/crossplane-fips-2.2 pkg:apk/chainguard/crossplane-fips-2.2-crank pkg:apk/chainguard/dockerd-fips-29 pkg:apk/chainguard/falcoctl pkg:apk/chainguard/falcoctl-fips pkg:apk/chainguard/gitsign pkg:apk/chainguard/image-factory pkg:apk/chainguard/image-factory-fips pkg:apk/chainguard/kubescape pkg:apk/chainguard/kubescape-server pkg:apk/chainguard/kubescape-server-downloader pkg:apk/chainguard/kubescape-server-fips pkg:apk/chainguard/kubescape-server-fips-downloader pkg:apk/chainguard/kyverno-1.16 pkg:apk/chainguard/kyverno-1.17 pkg:apk/chainguard/kyverno-1.18 pkg:apk/chainguard/kyverno-background-controller-1.16 pkg:apk/chainguard/kyverno-background-controller-1.17 pkg:apk/chainguard/kyverno-background-controller-1.18 pkg:apk/chainguard/kyverno-background-controller-fips-1.16 pkg:apk/chainguard/kyverno-background-controller-fips-1.17 pkg:apk/chainguard/kyverno-background-controller-fips-1.18 pkg:apk/chainguard/kyverno-cleanup-controller-1.16 pkg:apk/chainguard/kyverno-cleanup-controller-1.17 pkg:apk/chainguard/kyverno-cleanup-controller-1.18 pkg:apk/chainguard/kyverno-cleanup-controller-fips-1.16 pkg:apk/chainguard/kyverno-cleanup-controller-fips-1.17 pkg:apk/chainguard/kyverno-cleanup-controller-fips-1.18 pkg:apk/chainguard/kyverno-cli-1.16 pkg:apk/chainguard/kyverno-cli-1.17 pkg:apk/chainguard/kyverno-cli-1.18 pkg:apk/chainguard/kyverno-cli-fips-1.16 pkg:apk/chainguard/kyverno-cli-fips-1.17 pkg:apk/chainguard/kyverno-cli-fips-1.18 pkg:apk/chainguard/kyverno-fips-1.16 pkg:apk/chainguard/kyverno-fips-1.17 pkg:apk/chainguard/kyverno-fips-1.18 pkg:apk/chainguard/kyverno-init-container-1.16 pkg:apk/chainguard/kyverno-init-container-1.17 pkg:apk/chainguard/kyverno-init-container-1.18 pkg:apk/chainguard/kyverno-init-container-fips-1.16 pkg:apk/chainguard/kyverno-init-container-fips-1.17 pkg:apk/chainguard/kyverno-init-container-fips-1.18 pkg:apk/chainguard/kyverno-notation-aws pkg:apk/chainguard/kyverno-notation-aws-fips pkg:apk/chainguard/kyverno-reports-controller-1.16 pkg:apk/chainguard/kyverno-reports-controller-1.17 pkg:apk/chainguard/kyverno-reports-controller-1.18 pkg:apk/chainguard/kyverno-reports-controller-fips-1.17 pkg:apk/chainguard/kyverno-reports-controller-fips-1.18 pkg:apk/chainguard/neuvector-sigstore-interface pkg:apk/chainguard/neuvector-sigstore-interface-fips pkg:apk/chainguard/policy-controller pkg:apk/chainguard/policy-controller-fips pkg:apk/chainguard/policy-controller-tester pkg:apk/chainguard/policy-controller-tester-fips pkg:apk/chainguard/ratify pkg:apk/chainguard/ratify-fips pkg:apk/chainguard/spire-agent-fips pkg:apk/chainguard/tbot pkg:apk/chainguard/tekton-chains pkg:apk/chainguard/tekton-chains-fips pkg:apk/chainguard/teleport-17 pkg:apk/chainguard/teleport-17-kube-agent-updater pkg:apk/chainguard/teleport-17-operator pkg:apk/chainguard/teleport-17-tbot pkg:apk/chainguard/teleport-18 pkg:apk/chainguard/teleport-18-kube-agent-updater pkg:apk/chainguard/teleport-18-operator pkg:apk/chainguard/teleport-18-tbot pkg:apk/chainguard/teleport-operator-fips-17 pkg:apk/chainguard/teleport-operator-fips-18 pkg:apk/chainguard/tflint pkg:apk/chainguard/tflint-fips pkg:apk/chainguard/tkn pkg:apk/chainguard/tkn-fips pkg:apk/chainguard/trivy pkg:apk/chainguard/trivy-fips pkg:apk/chainguard/trivy-operator pkg:apk/chainguard/trivy-operator-fips pkg:apk/chainguard/zarf pkg:apk/chainguard/zarf-fips pkg:apk/wolfi/aactl pkg:apk/wolfi/crossplane-2.1 pkg:apk/wolfi/crossplane-2.2 pkg:apk/wolfi/crossplane-2.2-crank pkg:apk/wolfi/falcoctl pkg:apk/wolfi/gitsign pkg:apk/wolfi/kubescape pkg:apk/wolfi/kyverno-1.16 pkg:apk/wolfi/kyverno-1.17 pkg:apk/wolfi/kyverno-1.18 pkg:apk/wolfi/kyverno-background-controller-1.16 pkg:apk/wolfi/kyverno-background-controller-1.17 pkg:apk/wolfi/kyverno-background-controller-1.18 pkg:apk/wolfi/kyverno-cleanup-controller-1.16 pkg:apk/wolfi/kyverno-cleanup-controller-1.17 pkg:apk/wolfi/kyverno-cleanup-controller-1.18 pkg:apk/wolfi/kyverno-cli-1.16 pkg:apk/wolfi/kyverno-cli-1.17 pkg:apk/wolfi/kyverno-cli-1.18 pkg:apk/wolfi/kyverno-init-container-1.16 pkg:apk/wolfi/kyverno-init-container-1.17 pkg:apk/wolfi/kyverno-init-container-1.18 pkg:apk/wolfi/kyverno-notation-aws pkg:apk/wolfi/kyverno-reports-controller-1.16 pkg:apk/wolfi/kyverno-reports-controller-1.17 pkg:apk/wolfi/kyverno-reports-controller-1.18 pkg:apk/wolfi/neuvector-sigstore-interface pkg:apk/wolfi/policy-controller pkg:apk/wolfi/policy-controller-tester pkg:apk/wolfi/ratify pkg:apk/wolfi/tekton-chains pkg:apk/wolfi/teleport-17 pkg:apk/wolfi/teleport-18 pkg:apk/wolfi/teleport-18-kube-agent-updater pkg:apk/wolfi/teleport-18-operator pkg:apk/wolfi/tflint pkg:apk/wolfi/tkn pkg:apk/wolfi/trivy pkg:apk/wolfi/trivy-operator pkg:apk/wolfi/zarf
< 0.4.12-r62+ 134 more
- (no CPE)range: < 0.4.12-r62
- (no CPE)range: < 9.3.7-r2
- (no CPE)range: < 9.4.3-r2
- (no CPE)range: < 9.3.7-r2
- (no CPE)range: < 9.4.3-r2
- (no CPE)range: < 1.20.10-r6
- (no CPE)range: < 2.0.8-r13
- (no CPE)range: < 2.1.7-r6
- (no CPE)range: < 2.2.3-r7
- (no CPE)range: < 2.2.3-r7
- (no CPE)range: < 1.20.10-r6
- (no CPE)range: < 2.0.8-r13
- (no CPE)range: < 2.1.7-r6
- (no CPE)range: < 2.2.3-r8
- (no CPE)range: < 2.2.3-r8
- (no CPE)range: < 29.5.2-r12
- (no CPE)range: < 0.13.0-r13
- (no CPE)range: < 0.13.0-r11
- (no CPE)range: < 0.16.1-r5
- (no CPE)range: < 1.3.3-r7
- (no CPE)range: < 1.3.3-r8
- (no CPE)range: < 4.0.10-r7
- (no CPE)range: < 4.0.10-r7
- (no CPE)range: < 4.0.10-r7
- (no CPE)range: < 4.0.10-r7
- (no CPE)range: < 4.0.10-r7
- (no CPE)range: < 1.16.4-r15
- (no CPE)range: < 1.17.2-r19
- (no CPE)range: < 1.18.2-r0
- (no CPE)range: < 1.16.4-r15
- (no CPE)range: < 1.17.2-r19
- (no CPE)range: < 1.18.2-r0
- (no CPE)range: < 1.16.4-r15
- (no CPE)range: < 1.17.2-r15
- (no CPE)range: < 1.18.2-r6
- (no CPE)range: < 1.16.4-r15
- (no CPE)range: < 1.17.2-r19
- (no CPE)range: < 1.18.2-r0
- (no CPE)range: < 1.16.4-r15
- (no CPE)range: < 1.17.2-r15
- (no CPE)range: < 1.18.2-r6
- (no CPE)range: < 1.16.4-r15
- (no CPE)range: < 1.17.2-r19
- (no CPE)range: < 1.18.2-r0
- (no CPE)range: < 1.16.4-r15
- (no CPE)range: < 1.17.2-r15
- (no CPE)range: < 1.18.2-r6
- (no CPE)range: < 1.16.4-r15
- (no CPE)range: < 1.17.2-r15
- (no CPE)range: < 1.18.2-r6
- (no CPE)range: < 1.16.4-r15
- (no CPE)range: < 1.17.2-r19
- (no CPE)range: < 1.18.2-r0
- (no CPE)range: < 1.16.4-r15
- (no CPE)range: < 1.17.2-r15
- (no CPE)range: < 1.18.2-r6
- (no CPE)range: < 1.1-r68
- (no CPE)range: < 1.1-r60
- (no CPE)range: < 1.16.4-r15
- (no CPE)range: < 1.17.2-r19
- (no CPE)range: < 1.18.2-r0
- (no CPE)range: < 1.17.2-r15
- (no CPE)range: < 1.18.2-r6
- (no CPE)range: < 0_git20260617-r5
- (no CPE)range: < 0_git20260617-r7
- (no CPE)range: < 0.15.1-r18
- (no CPE)range: < 0.15.1-r14
- (no CPE)range: < 0.15.1-r18
- (no CPE)range: < 0.15.1-r14
- (no CPE)range: < 1.4.3-r1
- (no CPE)range: < 1.4.3-r1
- (no CPE)range: < 1.15.2-r0
- (no CPE)range: < 18.10.0-r1
- (no CPE)range: < 0.28.0-r0
- (no CPE)range: < 0.28.0-r0
- (no CPE)range: < 17.7.26-r5
- (no CPE)range: < 17.7.26-r5
- (no CPE)range: < 17.7.26-r5
- (no CPE)range: < 17.7.26-r5
- (no CPE)range: < 18.10.0-r1
- (no CPE)range: < 18.10.0-r1
- (no CPE)range: < 18.10.0-r1
- (no CPE)range: < 18.10.0-r1
- (no CPE)range: < 17.7.26-r4
- (no CPE)range: < 18.10.0-r2
- (no CPE)range: < 0.63.1-r6
- (no CPE)range: < 0.63.1-r5
- (no CPE)range: < 0.45.0-r10
- (no CPE)range: < 0.45.0-r7
- (no CPE)range: < 0.72.0-r4
- (no CPE)range: < 0.72.0-r4
- (no CPE)range: < 0.30.1-r25
- (no CPE)range: < 0.30.1-r21
- (no CPE)range: < 0.80.0-r6
- (no CPE)range: < 0.80.0-r7
- (no CPE)range: < 0.4.12-r62
- (no CPE)range: < 2.1.7-r6
- (no CPE)range: < 2.2.3-r7
- (no CPE)range: < 2.2.3-r7
- (no CPE)range: < 0.13.0-r13
- (no CPE)range: < 0.16.1-r5
- (no CPE)range: < 4.0.10-r7
- (no CPE)range: < 1.16.4-r15
- (no CPE)range: < 1.17.2-r19
- (no CPE)range: < 1.18.2-r0
- (no CPE)range: < 1.16.4-r15
- (no CPE)range: < 1.17.2-r19
- (no CPE)range: < 1.18.2-r0
- (no CPE)range: < 1.16.4-r15
- (no CPE)range: < 1.17.2-r19
- (no CPE)range: < 1.18.2-r0
- (no CPE)range: < 1.16.4-r15
- (no CPE)range: < 1.17.2-r19
- (no CPE)range: < 1.18.2-r0
- (no CPE)range: < 1.16.4-r15
- (no CPE)range: < 1.17.2-r19
- (no CPE)range: < 1.18.2-r0
- (no CPE)range: < 1.1-r68
- (no CPE)range: < 1.16.4-r15
- (no CPE)range: < 1.17.2-r19
- (no CPE)range: < 1.18.2-r0
- (no CPE)range: < 0_git20260617-r5
- (no CPE)range: < 0.15.1-r18
- (no CPE)range: < 0.15.1-r18
- (no CPE)range: < 1.4.3-r1
- (no CPE)range: < 0.28.0-r0
- (no CPE)range: < 17.7.26-r5
- (no CPE)range: < 18.10.0-r1
- (no CPE)range: < 18.10.0-r1
- (no CPE)range: < 18.10.0-r1
- (no CPE)range: < 0.63.1-r6
- (no CPE)range: < 0.45.0-r10
- (no CPE)range: < 0.72.0-r4
- (no CPE)range: < 0.30.1-r25
- (no CPE)range: < 0.80.0-r6

Patches

Vulnerability mechanics

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000