CVE-2026-49834: sigstore-go: Multi-log threshold bypass via single compromised log

Analyzed

AliasesUBUNTU-CVE-2026-49834DEBIAN-CVE-2026-49834CGA-26r9-7jhq-m62h+316 more

Published 17-07-2026Last modified 17-07-2026

Vulnerability summary

CVE-2026-49834 is a high (CVSS 7.5) vulnerability in sigstore sigstore-go. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 7.7% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 5.9, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

7.5/10

010

High · v3.1 (NVD)

EPSS score

0.18%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 4 · Related 2

OPENSUSE-SU-2026:21483-1 RHSA-2026:44162 RHSA-2026:47889 RHSA-2026:47891 CGA-2J38-CXFP-C8P6

Timeline

17-07-2026
PublishedVulnerability first disclosed.
17-07-2026
Last modifiedVulnerability information updated.

Description

sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.0, a verifier configured with WithTransparencyLog(N>1) or WithSignedCertificateTimestamps(N>1) counts verified witnesses per entry or per validation path rather than per log authority, allowing a single compromised transparency log or CT log to satisfy multi-log threshold requirements and defeat the multi-log policy. This issue is fixed in version 1.2.0.

CVSS metrics

7 scores · 7 sources · 1 version

v3.17.5

EPSS trend

Probability

0.18%

Chance of exploitation in the next 30 days

Percentile

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.18% on 05-10-2026

05-10-202604-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-347Improper Verification of Cryptographic SignatureThe product does not verify, or incorrectly verifies, the cryptographic signature for data.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard161 products

aactl< 0.4.12-r62
cloudbeat-9.3< 9.3.7-r2
cloudbeat-9.4< 9.4.3-r2
cloudbeat-fips-9.3< 9.3.7-r2
cloudbeat-fips-9.4< 9.4.3-r2

commercial-chainloop-backendAll versions (No fix recorded)
commercial-chainloop-cliAll versions (No fix recorded)
commercial-kyverno-1.13All versions (No fix recorded)
commercial-kyverno-1.14All versions (No fix recorded)
commercial-kyverno-1.15All versions (No fix recorded)
commercial-kyverno-1.16All versions (No fix recorded)
commercial-kyverno-1.17< 1.17.2-r0
commercial-kyverno-1.18All versions (No fix recorded)
commercial-kyverno-background-controller-1.13All versions (No fix recorded)
commercial-kyverno-background-controller-1.14All versions (No fix recorded)
commercial-kyverno-background-controller-1.15All versions (No fix recorded)
commercial-kyverno-background-controller-1.16All versions (No fix recorded)
commercial-kyverno-background-controller-1.17< 1.17.2-r0
commercial-kyverno-background-controller-1.18All versions (No fix recorded)
commercial-kyverno-cleanup-controller-1.13All versions (No fix recorded)
commercial-kyverno-cleanup-controller-1.14All versions (No fix recorded)
commercial-kyverno-cleanup-controller-1.15All versions (No fix recorded)
commercial-kyverno-cleanup-controller-1.16All versions (No fix recorded)
commercial-kyverno-cleanup-controller-1.17< 1.17.2-r0
commercial-kyverno-cleanup-controller-1.18All versions (No fix recorded)
commercial-kyverno-cli-1.18All versions (No fix recorded)
commercial-kyverno-reports-controller-1.13All versions (No fix recorded)
commercial-kyverno-reports-controller-1.14All versions (No fix recorded)
commercial-kyverno-reports-controller-1.15All versions (No fix recorded)
commercial-kyverno-reports-controller-1.16All versions (No fix recorded)
commercial-kyverno-reports-controller-1.17< 1.17.2-r0
commercial-kyverno-reports-controller-1.18All versions (No fix recorded)
commercial-kyvernopre-1.13All versions (No fix recorded)
commercial-kyvernopre-1.14All versions (No fix recorded)
commercial-kyvernopre-1.15All versions (No fix recorded)
commercial-kyvernopre-1.16All versions (No fix recorded)
commercial-kyvernopre-1.17< 1.17.2-r0
commercial-kyvernopre-1.18All versions (No fix recorded)
crossplane-1.20< 1.20.10-r6
crossplane-2.0< 2.0.8-r13
crossplane-2.1< 2.1.7-r6
crossplane-2.2< 2.2.3-r7
crossplane-2.2-crank< 2.2.3-r7
crossplane-2.3< 2.3.3-r35
crossplane-2.3-crank< 2.3.3-r35
crossplane-fips-1.20< 1.20.10-r6
crossplane-fips-2.0< 2.0.8-r13
crossplane-fips-2.1< 2.1.7-r6
crossplane-fips-2.2< 2.2.3-r8
crossplane-fips-2.2-crank< 2.2.3-r8
crossplane-fips-2.3< 2.3.3-r7
crossplane-fips-2.3-crank< 2.3.3-r7
dockerd-fips-29< 29.5.2-r12
falcoctl< 0.13.0-r13
falcoctl-fips< 0.13.0-r11
gitsign< 0.16.1-r5
image-factory< 1.3.3-r7
image-factory-fips< 1.3.3-r8
kubescape< 4.0.10-r7
kubescape-server< 4.0.10-r7
kubescape-server-downloader< 4.0.10-r7
kubescape-server-fips< 4.0.10-r7
kubescape-server-fips-downloader< 4.0.10-r7
kyverno-1.14All versions (No fix recorded)
kyverno-1.15All versions (No fix recorded)
kyverno-1.16< 1.16.4-r15
kyverno-1.17All versions (No fix recorded) | < 1.17.2-r35
kyverno-1.18< 1.18.2-r0
kyverno-background-controller-1.14All versions (No fix recorded)
kyverno-background-controller-1.15All versions (No fix recorded)
kyverno-background-controller-1.16< 1.16.4-r15
kyverno-background-controller-1.17< 1.17.2-r19
kyverno-background-controller-1.18< 1.18.2-r0
kyverno-background-controller-fips-1.14All versions (No fix recorded)
kyverno-background-controller-fips-1.15All versions (No fix recorded)
kyverno-background-controller-fips-1.16< 1.16.4-r15
kyverno-background-controller-fips-1.17< 1.17.2-r15
kyverno-background-controller-fips-1.18< 1.18.2-r6
kyverno-cleanup-controller-1.14All versions (No fix recorded)
kyverno-cleanup-controller-1.15All versions (No fix recorded)
kyverno-cleanup-controller-1.16< 1.16.4-r15
kyverno-cleanup-controller-1.17< 1.17.2-r19
kyverno-cleanup-controller-1.18< 1.18.2-r0
kyverno-cleanup-controller-fips-1.14All versions (No fix recorded)
kyverno-cleanup-controller-fips-1.15All versions (No fix recorded)
kyverno-cleanup-controller-fips-1.16< 1.16.4-r15
kyverno-cleanup-controller-fips-1.17< 1.17.2-r15
kyverno-cleanup-controller-fips-1.18< 1.18.2-r6
kyverno-cli-1.14All versions (No fix recorded)
kyverno-cli-1.15All versions (No fix recorded)
kyverno-cli-1.16< 1.16.4-r15
kyverno-cli-1.17< 1.17.2-r19 | < 1.17.2-r35
kyverno-cli-1.18< 1.18.1-r13 | < 1.18.2-r0
kyverno-cli-fips-1.14All versions (No fix recorded)
kyverno-cli-fips-1.15All versions (No fix recorded)
kyverno-cli-fips-1.16< 1.16.4-r15
kyverno-cli-fips-1.17< 1.17.2-r15
kyverno-cli-fips-1.18< 1.18.2-r6
kyverno-fips-1.14All versions (No fix recorded)
kyverno-fips-1.15All versions (No fix recorded)
kyverno-fips-1.16< 1.16.4-r15
kyverno-fips-1.17< 1.17.2-r15
kyverno-fips-1.18< 1.18.2-r6
kyverno-init-container-1.14All versions (No fix recorded)
kyverno-init-container-1.15All versions (No fix recorded)
kyverno-init-container-1.16< 1.16.4-r15
kyverno-init-container-1.17< 1.17.2-r19
kyverno-init-container-1.18< 1.18.2-r15
kyverno-init-container-fips-1.14All versions (No fix recorded)
kyverno-init-container-fips-1.15All versions (No fix recorded)
kyverno-init-container-fips-1.16< 1.16.4-r15
kyverno-init-container-fips-1.17< 1.17.2-r15
kyverno-init-container-fips-1.18< 1.18.2-r6
kyverno-notation-aws< 1.1-r68
kyverno-notation-aws-fips< 1.1-r60
kyverno-reports-controller-1.14All versions (No fix recorded)
kyverno-reports-controller-1.15All versions (No fix recorded)
kyverno-reports-controller-1.16< 1.16.4-r15
kyverno-reports-controller-1.17< 1.17.2-r19
kyverno-reports-controller-1.18< 1.18.2-r0
kyverno-reports-controller-fips-1.14All versions (No fix recorded)
kyverno-reports-controller-fips-1.15All versions (No fix recorded)
kyverno-reports-controller-fips-1.17< 1.17.2-r15
kyverno-reports-controller-fips-1.18< 1.18.2-r6
neuvector-sigstore-interface< 0_git20260617-r5
neuvector-sigstore-interface-fips< 0_git20260617-r7
policy-controller< 0.15.1-r18
policy-controller-fips< 0.15.1-r14
policy-controller-tester< 0.15.1-r18
policy-controller-tester-fips< 0.15.1-r14
ratify< 1.4.3-r1
ratify-fips< 1.4.3-r1
ratify-licensechecker-compat< 1.4.5-r4
slsa-verifierAll versions (No fix recorded)
spire-agent-fips< 1.15.2-r0
tbot< 18.10.0-r1
tekton-chains< 0.28.0-r0
tekton-chains-fips< 0.28.0-r0
teleport-17< 17.7.26-r5
teleport-17-kube-agent-updater< 17.7.26-r5
teleport-17-operator< 17.7.26-r5
teleport-17-tbot< 17.7.26-r5
teleport-18< 18.10.0-r1
teleport-18-kube-agent-updater< 18.10.0-r1
teleport-18-operator< 18.10.0-r1
teleport-18-tbot< 18.10.0-r1
teleport-18.6All versions (No fix recorded)
teleport-18.6-kube-agent-updaterAll versions (No fix recorded)
teleport-18.6-operatorAll versions (No fix recorded)
teleport-operator-fips-17< 17.7.26-r4
teleport-operator-fips-18< 18.10.0-r2
tflint< 0.63.1-r6
tflint-fips< 0.63.1-r5
tkn< 0.45.0-r10
tkn-fips< 0.45.0-r7
trivy< 0.72.0-r4
trivy-fips< 0.72.0-r4
trivy-operator< 0.30.1-r25
trivy-operator-fips< 0.30.1-r21
zarf< 0.80.0-r6
zarf-fips< 0.80.0-r7

Show all 161

Wolfi39 products

aactl< 0.4.12-r62
crossplane-2.1< 2.1.7-r6
crossplane-2.2< 2.2.3-r7
crossplane-2.2-crank< 2.2.3-r7
falcoctl< 0.13.0-r13

Show all 39

2 vendors · 200 products · Showing 200 of 206

References

10 links

github.com/sigstore/sigstore-go/security/advisories/GHSA-9vcr-p3rj-q5q6X Refsource CONFIRMREPORTAdvisoryWEBVendor Advisory
github.com/sigstore/sigstore-go/pull/633X Refsource MISCREPORTFIXWEBIssue TrackingPatch
github.com/sigstore/sigstore-go/commit/dbb07e62623edd5b175fb9dd5a41dcb85a159207X Refsource MISCFIXWEBPatch
github.com/sigstore/sigstore-go/releases/tag/v1.2.0X Refsource MISCWEBProductRelease Notes
ubuntu.com/security/CVE-2026-49834REPORT
www.cve.org/CVERecord?id=CVE-2026-49834REPORT
security-tracker.debian.org/tracker/CVE-2026-49834Advisory
github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49834.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2026-49834Advisory
github.com/sigstore/sigstore-goPACKAGE