CVE-2026-31830: sigstore Unchecked Return Value

Vulnerability summary

CVE-2026-31830 is a high (CVSS 7.5) Unchecked Return Value vulnerability in sigstore. EPSS estimates a 0.42% chance of exploitation in the next 30 days, higher than 35.3% of scored vulnerabilities.

Timeline

1. 10-03-2026
   PublishedVulnerability first disclosed.
2. 11-03-2026
   Last modifiedVulnerability information updated.

Description

sigstore-ruby is a pure Ruby implementation of the sigstore verify command from the sigstore/cosign project. Prior to 0.2.3, Sigstore::Verifier#verify does not propagate the VerificationFailure returned by verify_in_toto when the artifact digest does not match the digest in the in-toto attestation subject. As a result, verification of DSSE bundles containing in-toto statements returns VerificationSuccess regardless of whether the artifact matches the attested subject. This vulnerability is fixed in 0.2.3.

• CWE-252Unchecked Return ValueThe product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.