Keyless Signing Tool Vulnerability in Gitsign by Sigstore

CVE-2026-44309

What is CVE-2026-44309?

Gitsign, a keyless signing tool for Git commits, faced a significant security issue in versions prior to 0.16.0. The vulnerability arises during the verification process of commit and tag signatures when using the 'gitsign verify' and 'gitsign verify-tag' commands. This process incorrectly handles the encoding of commit/tag objects, leading to potential discrepancies between what various Git implementations interpret. Specifically, when malformed objects with duplicate tree headers are involved, an attacker can craft a signature that appears valid in Gitsign, while it does not correspond to the same content as interpreted by git-core. This disparity undermines signature verification integrity and can mislead users regarding the authenticity of commits. The issue has been rectified in version 0.16.0.

References