Policy Bypass Vulnerability in Gittuf by Gittuf Team

CVE-2026-128036

What is CVE-2026-128036?

The flaw in Gittuf, spanning versions 0.4.0 to 0.16.0, revolves around insufficient verification checks during policy updates. When a new policy update is made within the existing reference state log entries, the system only verifies the root of trust signatures of this new policy. This oversight allows a trusted user, bypassing standard policy application methods, to directly write to the policy reference and the reference state log. Consequently, they could inadvertently or intentionally enforce an invalid policy during verification, resulting in either the weakening or strengthening of security rules for subsequent changes. While the update is logged, the potential for policy manipulation poses significant security risks, necessitating users to upgrade to mitigate these vulnerabilities.

References