Vulnerability in Cosign Code Signing Tool by Sigstore

CVE-2026-24122

What is CVE-2026-24122?

In the affected versions of Cosign, when issuing certificates have an expiry date before the leaf certificate, they are incorrectly treated as valid during the verification process. This misconfiguration allows an expired issuing certificate to authenticate signatures, leading to potential security risks in environments with custom PKIs. While users of the public Sigstore infrastructure remain unaffected, it is essential for users with private deployments to upgrade to version 3.0.5 to mitigate this issue.

References