Insecure Artifact Verification in sigstore-ruby by Sigstore
CVE-2026-31830

7.5HIGH

Key Information:

Vendor

Sigstore

Status
Sigstore-ruby
Vendor
CVE Published:
10 March 2026

What is CVE-2026-31830?

The sigstore-ruby package, a pure Ruby implementation of the sigstore verify command, contains a vulnerability that fails to properly propagate a VerificationFailure when the artifact's digest does not coincide with the digest in the in-toto attestation subject. This oversight allows a verification process to report a VerificationSuccess even if the artifact does not truly match the expected subject, potentially leading to serious security implications. Users are advised to upgrade to version 0.2.3 or later to mitigate this issue.

Affected Version(s)

sigstore-ruby < 0.2.3

References

https://github.com/sigstore/sigstore-ruby/security/adviso...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.