Policy Update Flaw in Gittuf by Gittuf Inc.

CVE-2026-128035

What is CVE-2026-128035?

In specific versions of Gittuf (0.10.0 through 0.17.0), a flaw exists in the verification workflow that prevents it from loading necessary policy updates from an upstream controller repository after the initial verification. This limitation causes any subsequent updates to global rules—such as threshold requirements and force-push restrictions—to be disregarded, resulting in potential security risks where changes that should be prevented can inadvertently pass through the verification process.

References