CVE-2026-54787

Aliases:UBUNTU-CVE-2026-54787DEBIAN-CVE-2026-54787GHSA-wqqc-jjcq-vfxmGO-2026-6162CGA-248h-phxh-4r4mCGA-25gq-9fw6-qrfcCGA-2wcw-j38w-pchjCGA-377w-mh8m-wmrvCGA-3jrx-jj3q-vwj8CGA-3vg3-gg4j-q557CGA-43mw-wp8g-p6q7CGA-47q6-c5g6-8723CGA-48rx-8fw2-7vmhCGA-4gj2-jp6w-gvmgCGA-4r4j-g7h4-x5rrCGA-5gqr-4rxx-c848CGA-5gvc-263r-rch2CGA-5p84-9hxc-45vxCGA-5vpq-9gxf-h24cCGA-65hp-x8rm-p868CGA-68j8-fvgc-9x3hCGA-6jx9-mqmh-559rCGA-6pv5-gprg-fr2xCGA-6vh3-h59c-3cv3CGA-75mg-xr8p-272wCGA-78m9-6g4c-q6p5CGA-7v92-x343-w5r6CGA-873r-97m7-4p98CGA-8hjx-79pc-m79qCGA-93j8-vfxj-v7rfCGA-c3rf-w783-w9v9CGA-c4cf-272m-38mjCGA-c847-9x3r-5hjwCGA-c9vr-vpgg-rhgfCGA-f5mc-77mq-vwmwCGA-g5fh-qwvj-79q9CGA-ghhw-668c-x4rrCGA-gq72-2wpr-3pfwCGA-gq8m-635x-xw5mCGA-gqx6-mg7w-vv2qCGA-h6h9-vm7j-4pj3CGA-hfx2-p8g9-mm36CGA-hjgh-q88x-p5pmCGA-hvrq-chg5-8mxcCGA-jf5h-v524-cw3fCGA-jfxc-5qpp-h29rCGA-jjhg-4mjv-w7rhCGA-jm38-57p2-82pfCGA-jprp-rc8g-jrpvCGA-jrv2-5w45-pv45CGA-m55v-hx2q-rqf9CGA-m5j5-qh77-42jqCGA-mgp3-v8cv-xp93CGA-mh63-955x-2cxxCGA-p6g8-ffhx-54x5CGA-p7gc-5x29-7m5qCGA-pc7h-2h7h-g2j2CGA-233f-fcj2-c65qCGA-2696-2v8r-3fccCGA-26j6-v76x-692cCGA-26wq-2g4j-6j44CGA-273q-qg8h-xgrjCGA-29fw-v248-7874CGA-29q7-xc95-54cqCGA-2gqv-q7w5-7gpwCGA-2jx5-3mjj-gm59CGA-2qm6-3fxr-fwm5CGA-2rwr-9fp4-8vxgCGA-328x-w7pg-86xqCGA-34wc-mc5h-xhg8CGA-37gc-jr5f-54fqCGA-3872-8284-2fchCGA-3mpp-hxpq-gmv8CGA-3q47-fqxq-365vCGA-3qmm-fmrg-9mfgCGA-46f7-97jm-wx5wCGA-473v-grq8-4h27CGA-4cvc-rp4r-4gm5CGA-4cx6-3vq5-ffx4CGA-4qc5-6cp5-rw27CGA-542m-c89f-x5wpCGA-559r-j855-29mmCGA-5698-h37m-57fxCGA-56gv-2p6r-j6f9CGA-56j9-hjjg-6xmxCGA-58fx-m7cr-cmjvCGA-5cfc-p787-7f4xCGA-5cq5-qgjw-g4gpCGA-5g78-7372-vf3fCGA-5j47-966h-95j9CGA-5ppm-pv9g-7frmCGA-5r3p-4w4q-72x4CGA-5w24-q33r-m7prCGA-5x72-wghm-hwfvCGA-5x93-3q97-2x43CGA-5xh9-m89r-q65pCGA-623f-mc67-rwwvCGA-625m-xvmh-qr76CGA-6376-39cj-hrqrCGA-65pm-j574-4cf9CGA-668r-px5p-9cp3CGA-696m-534x-7c6qCGA-69pq-64fw-pmqjCGA-6fp7-fpvg-3pv6CGA-6g7x-53h5-4chvCGA-6h4j-hf8x-xgjqCGA-6hpj-hcfc-cvg9CGA-6wgf-498g-68v4CGA-6wm8-jx42-3p95CGA-6x3q-p4hf-8cvjCGA-6x69-hm3q-3v5qCGA-749j-v5hh-7qv8CGA-76gq-5w9r-pp43CGA-78fr-96h4-7r29CGA-7fqg-wppc-fhh7CGA-7h83-6fp3-m5rfCGA-7hm3-348w-x2j7CGA-7q8p-hm87-3vj6CGA-7r6r-8j9q-63hmCGA-82gr-q5wp-8cxhCGA-84r8-cvmp-wvj5CGA-8586-xw69-fjfhCGA-85h3-9hff-xjxhCGA-86pq-6676-w2hmCGA-88h7-9xjr-jx27CGA-8c5f-258v-g7qwCGA-8cgm-gchw-jfxxCGA-8f26-vrr8-8vwmCGA-8hg3-28vc-pxc2CGA-8jjw-xpf7-6rw2CGA-8m2c-qf9c-9543CGA-8mwr-8v33-cgf3CGA-8wf5-j39m-99xhCGA-925m-cpj7-jh2qCGA-933g-h6m6-rwq5CGA-954m-969m-6gqvCGA-9652-563g-j9fvCGA-96f5-9pmp-mvwfCGA-96gc-c622-5rqgCGA-97g4-4xg5-m536CGA-99pj-jcf4-q6hpCGA-9cjh-7vhw-xw94CGA-9hp5-54rq-w53wCGA-9m7j-pp5q-59vpCGA-9r94-63cp-6wvjCGA-9w8w-x5gq-f99cCGA-9wvw-w5j5-gv55CGA-c299-wxrc-mv5gCGA-c6j6-hr8j-c8h8CGA-cc96-wf2j-hgm8CGA-ccgf-gj56-3qqpCGA-chj9-7mj9-xfw2CGA-cp22-9x3f-w8vwCGA-cr8c-ggvc-3hwxCGA-cwrh-fhvj-4j2pCGA-f22q-g2hm-gxr3CGA-f2rv-wxm7-qvf9CGA-f3fv-xmpv-c77jCGA-f5wv-3mc4-323mCGA-f5x3-pvv6-4wcmCGA-f68f-wpr9-2v2gCGA-f68h-76mf-v92rCGA-f8cm-pj88-468vCGA-f9gm-5pjr-q4cpCGA-f9wm-gxfw-px2qCGA-fg62-jr2g-69jqCGA-fh2q-73r9-wqqwCGA-fh7g-w3m2-4qfpCGA-fjpg-xrg3-7vqwCGA-frmw-v7v9-27ffCGA-fvr3-22r5-85cfCGA-fw3f-frjp-x7rvCGA-fxvp-x7jc-v3gmCGA-g2q8-cf67-cj4xCGA-g3gw-m48q-mq65CGA-g42v-74j7-r3rhCGA-g55j-q3j8-f97gCGA-g87f-3w7w-xh28CGA-gf4x-v8h5-2rxcCGA-ghx7-6j67-qxp2CGA-gq8c-8rxh-8r9mCGA-gqc7-vrhw-x6qgCGA-gqff-2fwj-62q9CGA-gr7g-hh55-27p2CGA-grx4-g9xq-w9qhCGA-gvcw-phc6-j7mmCGA-gwgr-jc7f-vh47CGA-gwjm-m6mr-rqmmCGA-gx34-6mr3-r4g3CGA-gxqj-c6r2-gff7CGA-h32j-rg2x-m66xCGA-h349-3pj9-w4rcCGA-h6pv-xfh2-gpcjCGA-h834-pq54-4f4hCGA-h8cf-qfpf-2fhhCGA-h8pc-prxc-mr47CGA-hfwg-xh9x-rqxpCGA-hg39-rfp6-28vpCGA-hg3h-x6g3-8fg3CGA-hghc-69ww-3pw4CGA-hjfp-9m86-86q5CGA-hq2x-895x-rrmpCGA-hrv9-72mw-63f6CGA-hxj6-xmw3-q3jrCGA-j229-qcq8-pfx8CGA-j4h7-8h8c-6cjgCGA-j4r8-jv56-mwm6CGA-j59f-xm57-fvvjCGA-j6f2-x86j-phmrCGA-j6h4-hwcj-x2gfCGA-j6vx-qqpr-hp8gCGA-j7q9-7cc8-gr5wCGA-jf5g-f5v3-pm36CGA-jh7r-w7g8-h5wgCGA-jhr6-r5x4-w88wCGA-jhv7-39vq-gxh5CGA-jhw5-3gr5-2fvpCGA-jj58-22qj-54f7CGA-jjgh-mqpj-xw2jCGA-jm2q-w45q-fmcjCGA-jp22-4j89-3jx9CGA-jv34-mg8v-56xgCGA-jw98-w3ff-9rhrCGA-m5f9-5478-57gxCGA-m764-7v8w-hv87CGA-m78h-xpqx-jf2xCGA-mhg7-pgg5-c84rCGA-mjc5-rfqp-43j8CGA-mwj7-f593-7f48CGA-p397-qqhp-39gqCGA-p465-m324-rr2cCGA-p4w3-9rvm-4pxgCGA-p63c-g9vc-wh53CGA-p85c-3x2g-79cmCGA-ph8q-v7v8-q98fCGA-phxr-2hh6-rcx7CGA-pmfw-qj55-8cg3CGA-pmwj-f476-rrr4CGA-ppj9-jq8q-ffj9CGA-pqw9-8j5g-vw6xCGA-pqx2-h248-3x93CGA-pr2p-6wx9-wx88CGA-prjq-gr9g-4h72CGA-pvr6-2hjp-cxcfCGA-pvrf-mr57-cxjrCGA-pw3h-9wwp-3hxjCGA-pwqg-jq5q-3jj2CGA-q42g-pv83-4gwqCGA-q5wg-w7p7-qg94CGA-q93g-hr35-xrqfCGA-qchf-chcg-hcp8CGA-qf89-hf5j-fh5vCGA-qh9w-6gjj-5fhrCGA-qhg8-qhm4-2gqmCGA-qj76-w768-4p8fCGA-qjxr-2x5v-wc8cCGA-qpxx-jf6v-x4gpCGA-qq44-xm8j-wg5pCGA-qrv9-frpr-w7f4CGA-qw8x-gxqf-xph5CGA-qwhx-cvq4-jf76CGA-qxfp-fq45-ggmpCGA-qxg4-7vxv-jjpjCGA-qxj4-v4fw-hg7fCGA-r2fp-f4mv-3j2fCGA-r368-9r4h-p63vCGA-r3vv-m2r3-gpg6CGA-r6hj-r8gf-cp94CGA-r6q2-4765-3r3rCGA-r6vv-w8hv-mg3vCGA-r8xm-grmq-h5x7CGA-rc4q-j7xw-j937CGA-rg7p-8fgg-87v6CGA-rh2p-hjf8-qhmpCGA-rhgx-pcfh-q92rCGA-rhr9-cgj5-hpp7CGA-rj2x-p35r-wv9gCGA-rmrx-9cjm-wqv4CGA-rp4x-rhp4-p344CGA-rq5f-pgf3-fr67CGA-rq6c-jg6r-p3cpCGA-rqg2-9225-69j7CGA-rrm5-jc5w-qrmfCGA-rx93-xm7c-wccfCGA-v24x-v93q-vcr8CGA-v356-v2hp-74h6CGA-v38p-fmfc-r2hwCGA-v89g-fhfw-c57rCGA-vfp6-vv22-c3q3CGA-vhc3-854r-677wCGA-vhm5-wf4m-wv36CGA-vhw7-4f6w-fgpxCGA-vm2v-2g9f-g4p6CGA-vq9x-3phv-42g7CGA-vr2v-vjpw-6gg2CGA-vrrr-qjvh-9hjjCGA-vv98-w563-frfqCGA-vx7q-fmj2-3rcwCGA-w5g4-6x4p-4p5cCGA-w7vw-hrg4-3ff2CGA-w8gj-chc4-m72pCGA-w8j3-qwx5-j7vqCGA-w93g-5hq6-p8pgCGA-wc5p-h7rf-c7pwCGA-wg54-f84c-62c6CGA-wgcm-6j7r-g264CGA-wgwq-m5fp-hhwrCGA-wmvp-9fqm-ppcgCGA-wp27-3c27-6895CGA-wp55-x64q-m2fqCGA-wpfv-qjw7-jgpwCGA-wqjv-x4h4-687hCGA-wv3v-5m3h-gp63CGA-wv5j-xg4p-7g44CGA-wxpf-89fq-wwc6CGA-wxwf-786g-m569CGA-x2ww-qfgw-x8r8CGA-x775-cx64-xhc4CGA-x8vq-9j3g-x2c4CGA-x9hj-xvvc-549fCGA-xg8r-qvqv-j3x4CGA-xhjf-mg97-7g98CGA-xhm6-q67r-v6mwCGA-xm7q-c8c2-j97xCGA-xmqq-7w4p-mc3hCGA-xx4g-fmjv-w24wCGA-xxq5-wv67-r3ccCGA-246h-254j-gwqqCGA-4c3x-9mx3-8cccCGA-833m-4x9x-wgxgCGA-xchg-w559-jr5c
Advisory lineage Upstream: 0 Downstream: 5
Awaiting Analysis
Published: 31 Jul 2026, 21:58
Last modified:31 Jul 2026, 23:36

Vulnerability Summary

Overall Risk (default)
low
12/100
CVSS Score
3.1 LOW
v3.1 (cve.org)
EPSS Score
0.09% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

31 Jul 2026, 21:58
Published
Vulnerability first disclosed
31 Jul 2026, 23:36
Last Modified
Vulnerability information updated

Description

sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired key material to sign accepted bundles. This issue is fixed in version 1.2.1.

CVSS Metrics

  • v3.1•LOW•Score: 3.1CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS Trends

Current EPSS score: 0.09%• Percentile: 1%

Techniques & Countermeasures

  • CWE-324•Use of a Key Past its Expiration Date

    The product uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing window for cracking attacks against that key.

Affected Systems

  • chainguard•aactl

    < 0.4.12-r67

  • chainguard•cloudbeat-9.3

    < 9.3.8-r2

  • chainguard•cloudbeat-9.4

    < 9.4.4-r2

  • chainguard•cloudbeat-fips-9.3

    < 9.3.8-r2

  • chainguard•cloudbeat-fips-9.4

    < 9.4.4-r2

  • chainguard•commercial-chainloop-backend

    all

  • chainguard•commercial-chainloop-cli

    all

  • chainguard•commercial-kyverno-1.13

    all

  • chainguard•commercial-kyverno-1.14

    all

  • chainguard•commercial-kyverno-1.15

    all

  • chainguard•commercial-kyverno-1.16

    all

  • chainguard•commercial-kyverno-1.17

    all

  • chainguard•commercial-kyverno-background-controller-1.13

    all

  • chainguard•commercial-kyverno-background-controller-1.14

    all

  • chainguard•commercial-kyverno-background-controller-1.15

    all

  • chainguard•commercial-kyverno-background-controller-1.16

    all

  • chainguard•commercial-kyverno-background-controller-1.17

    all

  • chainguard•commercial-kyverno-cleanup-controller-1.13

    all

  • chainguard•commercial-kyverno-cleanup-controller-1.14

    all

  • chainguard•commercial-kyverno-cleanup-controller-1.15

    all

  • chainguard•commercial-kyverno-cleanup-controller-1.16

    all

  • chainguard•commercial-kyverno-cleanup-controller-1.17

    all

  • chainguard•commercial-kyverno-reports-controller-1.13

    all

  • chainguard•commercial-kyverno-reports-controller-1.14

    all

  • chainguard•commercial-kyverno-reports-controller-1.15

    all

  • chainguard•commercial-kyverno-reports-controller-1.16

    all

  • chainguard•commercial-kyverno-reports-controller-1.17

    all

  • chainguard•commercial-kyvernopre-1.13

    all

  • chainguard•commercial-kyvernopre-1.14

    all

  • chainguard•commercial-kyvernopre-1.15

    all

  • chainguard•commercial-kyvernopre-1.16

    all

  • chainguard•commercial-kyvernopre-1.17

    all

  • chainguard•cosign-2

    < 2.6.4-r1

  • chainguard•cosign-fips-2

    < 2.6.4-r1

  • chainguard•crossplane-1.20

    < 1.20.11-r1

  • chainguard•crossplane-2.0

    < 2.0.8-r17

  • chainguard•crossplane-2.1

    < 2.1.8-r2

  • chainguard•crossplane-2.2

    < 2.2.4-r2

  • chainguard•crossplane-2.2-crank

    < 2.2.4-r2

  • chainguard•crossplane-2.3

    < 2.3.4-r3

  • chainguard•crossplane-2.3-crank

    < 2.3.4-r3

  • chainguard•crossplane-fips-1.20

    < 1.20.11-r2

  • chainguard•crossplane-fips-2.0

    < 2.0.8-r18

  • chainguard•crossplane-fips-2.1

    < 2.1.8-r3

  • chainguard•crossplane-fips-2.2

    < 2.2.4-r3

  • chainguard•crossplane-fips-2.2-crank

    < 2.2.4-r3

  • chainguard•crossplane-fips-2.3

    < 2.3.4-r3

  • chainguard•crossplane-fips-2.3-crank

    < 2.3.4-r3

  • chainguard•dockerd-fips-29

    < 29.5.2-r16

  • chainguard•falcoctl

    < 0.13.0-r17

Showing first 50 affected entries in server-rendered view.

References (10)