File Overwrite Vulnerability in Sigstore Framework - Go Library by Sigstore

CVE-2026-24137

What is CVE-2026-24137?

The Sigstore Framework, a widely used Go library, is susceptible to a file overwrite vulnerability due to improper path validation in its legacy TUF client. This issue allows a malicious repository to exploit the caching mechanism, leading to arbitrary file overwriting within the constraints of the process's permissions. Affected environments include users directly utilizing the TUF client in sigstore/sigstore or older versions of Cosign. Users of public Sigstore deployments remain secure, as TUF metadata is validated through trusted collaborations. Mitigation methods involve updating to version 1.10.4 or disabling disk caching for the legacy client by setting SIGSTORE_NO_CACHE=true.

References