CVE-2026-49834

Aliases:GHSA-9vcr-p3rj-q5q6GO-2026-5952UBUNTU-CVE-2026-49834DEBIAN-CVE-2026-49834CGA-26r9-7jhq-m62hCGA-2f73-pmjh-qh3wCGA-2p6p-gwm8-8x7hCGA-2v7p-c2x4-rqc2CGA-2xv7-7prf-c9jrCGA-34pj-pmwm-pc2fCGA-3542-pv6x-h834CGA-355f-xf8x-q59fCGA-3679-vfc5-p2wwCGA-3hw6-q32w-7xqqCGA-3p48-vcxx-6p9cCGA-438p-96fm-gm2qCGA-47gj-5p34-p6m5CGA-4gg7-3h9v-gj4vCGA-4jg9-j53p-5cv4CGA-4mj5-r86v-42q4CGA-5c59-96xg-v9h5CGA-5gpw-3824-9m2qCGA-5h7r-jh5m-793qCGA-5hqj-gxgv-j2f8CGA-5qp8-mg69-x4fjCGA-6588-p8gr-92rrCGA-6v5f-fmgf-89hcCGA-6vhv-m5px-66pwCGA-6wx7-vf3x-m9j4CGA-6x56-f6jq-gc88CGA-7xcp-cjj9-qhg8CGA-833f-6gwm-fm89CGA-84h8-22c2-c4w2CGA-85cw-73m8-j3ghCGA-88jh-3hjx-52fjCGA-8jjp-438x-r6xxCGA-8jqx-hcp4-phqfCGA-8p3v-9w6c-29cgCGA-8ppj-mhg7-v86gCGA-8qvm-46xf-5hxwCGA-8qw7-hh5p-f4w3CGA-92gv-j3p4-vx47CGA-9427-6jcp-75f2CGA-9hwg-wjp5-xh7xCGA-9jj4-m8j2-pm5wCGA-9q77-jxjc-hgwwCGA-c3x5-gv42-6h52CGA-c62m-26wr-fmcfCGA-c766-rccq-f7mfCGA-ccjj-xp38-7636CGA-f3q6-65mg-gv8pCGA-fg38-5xgp-p76wCGA-g9wr-xf4p-xgmxCGA-ghv2-7jj3-m9fgCGA-grcm-695g-v65mCGA-gwhc-6674-wgc4CGA-h9p5-jgpv-rw9pCGA-hgmj-59f9-3mrfCGA-j2fv-9c25-8c47CGA-jf23-2948-89g3CGA-m7mq-4mvj-ggjhCGA-mr2x-6f4f-jm6vCGA-pwx9-xxhr-p358CGA-22f3-77j8-vh3vCGA-22g6-4qwx-2m75CGA-23hv-fhgw-rxxpCGA-243w-jw5x-6wv5CGA-2478-g4qm-rm63CGA-2hqv-xg89-69qmCGA-2m9q-6q73-7v49CGA-2mgj-vw4x-65fcCGA-2q8c-w69q-hqmfCGA-2qg4-4f6p-3xxhCGA-2x4x-rghc-q66vCGA-32rw-h8hc-99q7CGA-33cq-x792-x56jCGA-35p5-42wc-r5gxCGA-35ph-qm2m-8c7cCGA-3f53-hfx8-v5jqCGA-3fch-8j9f-cpqjCGA-3jp3-vfxm-586pCGA-3m4q-2c4q-5xgxCGA-3m66-84wv-xjq4CGA-3mmh-p9fh-vgpgCGA-3mqv-7h6j-p296CGA-3q75-r43x-3cjhCGA-3vw2-23vw-vw48CGA-425p-2234-7mrfCGA-42p4-h94x-w3j8CGA-43pm-x7pj-rmv6CGA-473x-47q4-x94rCGA-4xm4-4xf4-3jjvCGA-54cp-7qr8-f9hjCGA-57rm-wqwc-393hCGA-57xg-vj4f-h55qCGA-5973-9fvh-qjc8CGA-59gp-46f7-5c63CGA-5cgx-8q87-6w34CGA-5g98-p4cm-vfr5CGA-5jj4-jgp6-vph3CGA-5m3h-4hc9-pcvpCGA-5pj9-p8jm-c3ghCGA-5ppg-679g-v46xCGA-5vqf-h7w8-3355CGA-66pw-6c9v-j4v8CGA-676f-hmc8-29gfCGA-68qv-2cq8-2m45CGA-6h85-6vfp-g78jCGA-6jfp-c23m-7828CGA-6mvr-m334-52pwCGA-6q2v-g97q-343fCGA-6wjv-7xph-gmhpCGA-6xcp-3935-vpxgCGA-728q-hp2q-58vrCGA-729w-wfcx-g92qCGA-738v-jjx8-3v54CGA-768p-2g4v-9pf7CGA-772f-595r-5hm4CGA-7fcr-64ch-c2hvCGA-7fh5-fq8w-rq27CGA-7gh2-87xw-xq69CGA-7h3g-v8h3-2f29CGA-7hxx-7g79-35fwCGA-7mxx-q43j-8qx8CGA-7q4v-62w2-ccq2CGA-7qj4-x775-5g9gCGA-7v5m-cgxm-7gc6CGA-7vxf-g4c5-7j52CGA-7wm2-8mpg-3c5hCGA-7x5f-42h6-m6j3CGA-7xgj-36hv-3g59CGA-822h-8vqc-5623CGA-82rc-f9f5-9xm6CGA-83c9-2r5r-pxv6CGA-84q7-rvgm-cw88CGA-85j4-mm7g-2xc2CGA-86h2-cmjw-qv3wCGA-88m4-wh6h-4r59CGA-89pw-vrvv-vhmpCGA-8c5p-47mf-cqqjCGA-8mf3-w4rq-4c7fCGA-8q9h-c8mg-rpj8CGA-994c-7w2c-24p2CGA-99rg-5mvf-78j7CGA-9fm7-p5wv-wrx5CGA-9gxc-746m-m7f3CGA-9jv9-mmqp-27xxCGA-9rfj-q4q6-hrm7CGA-9rxj-ppr4-mxp3CGA-9xp6-526p-5mc4CGA-c27g-j6mf-27jvCGA-c33p-4x5j-4x7cCGA-c4m7-v8f2-854mCGA-c529-3xc7-2pfrCGA-c62m-43fw-pgwhCGA-c6qj-wg7j-rc7xCGA-c7x9-vp62-h6cfCGA-c8q7-567v-3c4qCGA-c983-9pc7-9gvqCGA-cc2j-6vwc-wp68CGA-cf2f-j564-7pc9CGA-cgh4-h6hf-wp32CGA-f286-gg9x-9cg6CGA-f333-q8x7-pv7rCGA-f73g-mfvq-w2qgCGA-f83f-24hg-22c8CGA-fchm-vj3c-q2p2CGA-fhwh-7pxc-vj7qCGA-fmhc-8h95-54hgCGA-fv42-fj7r-hprpCGA-g639-hjq5-7v67CGA-gg4v-j2r9-234mCGA-gj47-8vwq-wrv4CGA-gjw8-m789-c4wfCGA-gm8x-g9ch-75cwCGA-gp74-mj9r-7rpjCGA-gpx9-ffg8-79rpCGA-grw6-pwcj-4jq8CGA-h328-7q54-34m9CGA-h53f-hq98-xhq2CGA-h6x2-92fx-fv5cCGA-h874-c2vv-qhc6CGA-h9xj-89h5-f36hCGA-h9xp-mfqp-89cwCGA-hc82-9p79-j8rvCGA-hjqj-37g9-4f45CGA-hv69-x4vx-j2qpCGA-hw5f-47rg-r756CGA-j2jv-56c9-jhcwCGA-j697-cpmf-q8wpCGA-j8v6-7fj2-2p9xCGA-j965-xq9r-v468CGA-jc6v-rw5v-jm92CGA-jcrj-h4vw-j3c4CGA-jf2j-876h-48p3CGA-jh5x-7vmc-x8hhCGA-jh68-m85m-7556CGA-jhr9-qvr6-2gq2CGA-jq2j-qp65-5pxjCGA-jvgg-fg6g-qj3cCGA-jw99-58q9-9xrxCGA-jxcc-c28m-7hq2CGA-jxvf-j4r5-2qcmCGA-m296-8vgw-rrmcCGA-m2ph-64hg-9w36CGA-m32w-wqgq-qrprCGA-m43m-fh9c-g53vCGA-m4cj-qf95-ffx5CGA-m4f7-7gpc-g62pCGA-m4rj-f7h2-mf74CGA-mchp-39wg-hmwqCGA-mfpr-chh7-9mpxCGA-mhj3-wc7c-4h8gCGA-mj99-7jhm-6897CGA-mm86-x264-7qh5CGA-mv9f-fjx7-c32fCGA-mwjv-hv3w-6rrxCGA-mxx2-c7gr-jpv3CGA-pc92-c2g3-36mxCGA-pf83-j78g-8qj5CGA-pfv2-f73x-jm3mCGA-pgv5-px69-hwh7CGA-ph2h-4jgm-4w2qCGA-phhc-gmxm-ppxfCGA-pj5p-8vxw-jvpxCGA-pj6v-7p22-8ff3CGA-pjcw-649j-hxjcCGA-pw9x-2j9c-p88hCGA-pwh4-gh3m-268fCGA-px9h-wf35-fg8pCGA-pxw6-378g-4gvpCGA-q28f-x7gj-gxc9CGA-q5jp-fmj3-w6h8CGA-q73x-8494-8p5jCGA-q8pc-4x7r-9g8jCGA-qf5g-c36j-h346CGA-qfm5-m9c7-68h9CGA-qjmg-5vp2-4jvrCGA-qmpm-vg7q-64j5CGA-qmpr-qgv7-7994CGA-qrfv-32m8-grcgCGA-qrmr-5fxj-22hmCGA-qvxv-jvmq-6rmrCGA-qw9m-g46g-8qvrCGA-r2gj-c542-6rxrCGA-r2w9-hh3w-4gmvCGA-r3cf-gvvv-ghwmCGA-r3wp-w2hr-f639CGA-r628-p873-c4qgCGA-r7j9-px2f-wvj9CGA-r7wj-7xc5-m63fCGA-r8vc-7j8h-m72vCGA-r9cp-x4x7-4xpjCGA-rc2q-6cvw-29gwCGA-rcvj-2r55-4xcmCGA-rf74-pv4v-h4m4CGA-rfgw-2qhm-3v63CGA-rg5x-4756-3744CGA-rgmr-gr9q-4mmrCGA-rh25-74pp-68xmCGA-rj8q-7x6h-x383CGA-rm82-9f69-7jw2CGA-rq7f-h683-wp5xCGA-rq8v-3rh8-hg86CGA-rv29-rw93-j2gqCGA-rvvq-c86m-vm38CGA-rx3r-f4r5-2hhqCGA-v4jv-qv4m-rj9wCGA-v4v7-v93g-h9gjCGA-v756-gw33-q26cCGA-v78v-4mxp-vx3hCGA-v957-mxx6-5jv9CGA-v9xc-vmf7-5rfxCGA-v9xq-c52q-3p7fCGA-vf33-362v-wr5fCGA-vfq6-jccp-mvgxCGA-vj29-f94q-jw37CGA-vxv2-cq7q-xg3pCGA-w3xq-jwm5-wqqmCGA-w623-r774-5fp7CGA-w7f7-9w6q-jp7wCGA-w82h-6f28-2vm8CGA-wfcq-mhfq-8fm2CGA-wh48-6279-gxv4CGA-wq35-hm24-ph9cCGA-wrqw-xf46-q7jwCGA-wvcq-ggg4-7hg8CGA-wxj4-5jh2-2242CGA-wxq9-45fp-9rmrCGA-wxr2-cphr-v9hpCGA-wxwp-j9g2-jqppCGA-x29g-w99g-8wf5CGA-x46j-vp78-jqj4CGA-x8rw-phvr-c4qvCGA-xfp8-42cw-q58hCGA-xggp-wxqh-jr4vCGA-xh96-mrw2-vjpmCGA-xmfw-76wv-7gm3CGA-xp63-xcjp-m4f6CGA-xv4h-mpx7-chccCGA-xv83-9jgc-27qrCGA-xwwh-49p5-gm27CGA-65ch-w9fc-9mhvCGA-6q9w-r36w-fv34CGA-c45p-998p-phmhCGA-rqf5-p789-rc53CGA-wfp7-99f9-h4j8
Advisory lineage Upstream: 0 Downstream: 6
Analyzed
Published: 17 Jul 2026, 19:20
Last modified:17 Jul 2026, 19:42

Vulnerability Summary

Overall Risk (default)
medium
30/100
CVSS Score
7.5 HIGH
v3.1 (nvd)
EPSS Score
0.11% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

17 Jul 2026, 19:20
Published
Vulnerability first disclosed
17 Jul 2026, 19:42
Last Modified
Vulnerability information updated

Description

sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.0, a verifier configured with WithTransparencyLog(N>1) or WithSignedCertificateTimestamps(N>1) counts verified witnesses per entry or per validation path rather than per log authority, allowing a single compromised transparency log or CT log to satisfy multi-log threshold requirements and defeat the multi-log policy. This issue is fixed in version 1.2.0.

CVSS Metrics

  • v3.1•MEDIUM•Score: 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS Trends

Current EPSS score: 0.11%• Percentile: 2%

Techniques & Countermeasures

  • CWE-347•Improper Verification of Cryptographic Signature

    The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Affected Systems

  • chainguard•aactl

    < 0.4.12-r62

  • chainguard•cloudbeat-9.3

    < 9.3.7-r2

  • chainguard•cloudbeat-9.4

    < 9.4.3-r2

  • chainguard•cloudbeat-fips-9.3

    < 9.3.7-r2

  • chainguard•cloudbeat-fips-9.4

    < 9.4.3-r2

  • chainguard•commercial-chainloop-backend

    all

  • chainguard•commercial-chainloop-cli

    all

  • chainguard•commercial-kyverno-1.13

    all

  • chainguard•commercial-kyverno-1.14

    all

  • chainguard•commercial-kyverno-1.15

    all

  • chainguard•commercial-kyverno-1.16

    all

  • chainguard•commercial-kyverno-1.17

    all

  • chainguard•commercial-kyverno-background-controller-1.13

    all

  • chainguard•commercial-kyverno-background-controller-1.14

    all

  • chainguard•commercial-kyverno-background-controller-1.15

    all

  • chainguard•commercial-kyverno-background-controller-1.16

    all

  • chainguard•commercial-kyverno-background-controller-1.17

    all

  • chainguard•commercial-kyverno-cleanup-controller-1.13

    all

  • chainguard•commercial-kyverno-cleanup-controller-1.14

    all

  • chainguard•commercial-kyverno-cleanup-controller-1.15

    all

  • chainguard•commercial-kyverno-cleanup-controller-1.16

    all

  • chainguard•commercial-kyverno-cleanup-controller-1.17

    all

  • chainguard•commercial-kyverno-reports-controller-1.13

    all

  • chainguard•commercial-kyverno-reports-controller-1.14

    all

  • chainguard•commercial-kyverno-reports-controller-1.15

    all

  • chainguard•commercial-kyverno-reports-controller-1.16

    all

  • chainguard•commercial-kyverno-reports-controller-1.17

    all

  • chainguard•commercial-kyvernopre-1.13

    all

  • chainguard•commercial-kyvernopre-1.14

    all

  • chainguard•commercial-kyvernopre-1.15

    all

  • chainguard•commercial-kyvernopre-1.16

    all

  • chainguard•commercial-kyvernopre-1.17

    all

  • chainguard•crossplane-1.20

    < 1.20.10-r6

  • chainguard•crossplane-2.0

    < 2.0.8-r13

  • chainguard•crossplane-2.1

    < 2.1.7-r6

  • chainguard•crossplane-2.2

    < 2.2.3-r7

  • chainguard•crossplane-2.2-crank

    < 2.2.3-r7

  • chainguard•crossplane-2.3

    < 2.3.3-r35

  • chainguard•crossplane-2.3-crank

    < 2.3.3-r35

  • chainguard•crossplane-fips-1.20

    < 1.20.10-r6

  • chainguard•crossplane-fips-2.0

    < 2.0.8-r13

  • chainguard•crossplane-fips-2.1

    < 2.1.7-r6

  • chainguard•crossplane-fips-2.2

    < 2.2.3-r8

  • chainguard•crossplane-fips-2.2-crank

    < 2.2.3-r8

  • chainguard•crossplane-fips-2.3

    < 2.3.3-r7

  • chainguard•crossplane-fips-2.3-crank

    < 2.3.3-r7

  • chainguard•dockerd-fips-29

    < 29.5.2-r12

  • chainguard•falcoctl

    < 0.13.0-r13

  • chainguard•falcoctl-fips

    < 0.13.0-r11

  • chainguard•gitsign

    < 0.16.1-r5

Showing first 50 affected entries in server-rendered view.

References (10)