Software Supply Chain Vulnerability in Rekor by Sigstore

CVE-2026-23831

What is CVE-2026-23831?

A vulnerability exists in the Rekor software supply chain transparency log, specifically in versions 1.4.3 and earlier. Malicious attackers can exploit this flaw by submitting a crafted input that contains an empty specification message. This leads to a nil pointer dereference in the Canonicalize() function, as the validate() function incorrectly permits an uninitialized state for critical variables. Consequently, this may result in a panic within the Rekor service, causing it to return a generic 500 error message to clients. Despite this error, service continuity is maintained, minimizing disruption. The vulnerability has been addressed in version 1.5.0.

References