Vulnerability in Cosign Affects Container Code Signing and Transparency

CVE-2026-22703

What is CVE-2026-22703?

Cosign, a tool for code signing and ensuring transparency for containers and binaries, has a security vulnerability that allows a crafted bundle to successfully verify an artifact even if the associated Rekor entry does not reference the artifact's digest, signature, or public key. This flaw arises because the verification process fails to properly compare relevant entries, leading to potential acceptance of any Rekor response as valid. If an attacker compromises a user’s identity or signing key, they could create a fraudulent Cosign bundle by including an arbitrary Rekor entry. This undermines the ability of users to audit signing events effectively. To mitigate this issue, users are advised to upgrade to Cosign versions 2.6.2 or 3.0.4, where the issue has been resolved.

References