Cosign
CVE-2026-24122
LOW
GHSA-wfqv-66vq-46rm
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V14 - Configuration Dependency management, component inventory
|
| Impact | CVSS 3.7 (LOW). Attack vector: Network. Complexity: High. Privileges required: None. User interaction: None. Public exploit/POC available. |
| Exploit ScenarioDerived | An attacker could exploit this vulnerability to compromise the affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Cosign provides code signing and transparency for containers and binaries. [CVSS 3.7 LOW]
RemediationAI
A vendor patch is available — apply it immediately. Fixed in version 3.0.5.. Restrict network access to the affected service where possible.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in go
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Classified as CWE-295 (Improper Certificate Validation). Affects Cosign. Cosign provides code signing and transparency for containers and binaries. In versions 3.0.4 and below, an issuing certificate with a validity that expires before the leaf certificate will be considered valid during verification even if the provided timestamp would mean the issuing certificate should be considered expired. When verifying artifact signatures using a certificate, Cosign first verifies the certificate chain using the leaf certificate's "not before" timestamp and later checks expiry
Know when Cosign gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
Cosign provides code signing and transparency for containers and binaries. In versions 3.0.4 and below, an issuing certificate with a validity that expires before the leaf certificate will be considered valid during verification even if the provided timestamp would mean the issuing certificate should be considered expired. When verifying artifact signatures using a certificate, Cosign first verifies the certificate chain using the leaf certificate's "not before" timestamp and later checks expiry of the leaf certificate using either a signed timestamp provided by the Rekor transparency log or from a timestamp authority, or using the current time. The root and all issuing certificates are assumed to be valid during the leaf certificate's validity. There is no impact to users of the public Sigstore infrastructure. This may affect private deployments with customized PKIs. This issue has been fixed in version 3.0.5.
Executive ViewAI
CVE-2026-24122 is a low-severity vulnerability (CVSS 3.7). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation. A patch is available and can be applied during standard maintenance windows.
Apply vendor patch during routine maintenance. Standard security controls provide adequate interim protection.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)GitHub Advisory
cosign is a container signing and verification utility. Rated critical severity (CVSS 9.8), this vulnerability is remote
Cosign provides code signing and transparency for containers and binaries. Rated high severity (CVSS 7.5), this vulnerab
Cosign's bundle verification mechanism fails to properly validate that embedded Rekor entries reference the correct arti
Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure. Rated medium
Cosign is a sigstore signing tool for OCI containers. Rated medium severity (CVSS 5.3), this vulnerability is remotely e
Cosign provides code signing and transparency for containers and binaries. Rated medium severity (CVSS 5.9), this vulner
Cosign verify-blob-attestation incorrectly validates attestation signatures and predicate types in versions before 3.0.6
Cosign provides container signing, verification, and storage in an OCI registry for the sigstore project. Rated low seve
Exploit-DB