VYPR
← All advisories
Low severity3.1NVD Advisory· Published Jul 31, 2026· Updated Sep 10, 2026

CVE-2026-54787

CVE-2026-54787

Description

sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired key material to sign accepted bundles. This issue is fixed in version 1.2.1.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/sigstore/sigstore-goGo
< 1.2.11.2.1

Affected products

144

Patches

Vulnerability mechanics

References

5

News mentions

0

No linked articles in our index yet.