What is the CVSS score of CVE-2026-31830?

CVE-2026-31830 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-31830?

Within 24 hours: Identify all systems and applications using sigstore-ruby and document their criticality; notify development and security teams of the vulnerability. Within 7 days: Implement compensating controls by disabling DSSE bundle verification until patches are available, or isolate affected systems from production environments; conduct code review of any recent artifact verifications. Within 30 days: Monitor sigstore-ruby project releases for version 0.2.3 or later; plan and execute upgrade once patch is available; validate verification logic post-upgrade with test artifacts.

Sigstore CVE-2026-31830

HIGH

Unchecked Return Value (CWE-252)

2026-03-10 security-advisories@github.com

GHSA-mhg6-2q2v-9h2c

Information Disclosure Sigstore

7.5

CVSS 3.1 · GitHub Advisory

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Craft malicious DSSE bundle with mismatched artifact digest
Exploit

Submit bundle to sigstore-ruby verifier
Execution

Verification incorrectly returns success
Impact

Bypass integrity checks

Vulnerability Assessment

Weakness	CWE CWE-252 OWASP Top 10:2025 A10:2025 - Mishandling of Exceptional Conditions ASVS 5.0 V16 - Security Logging and Error Handling Return value checking
Exploitation Conditions	sigstore-ruby versions prior to 0.2.3 with DSSE bundle verification enabled. No special conditions — remote unauthenticated exploitation of default verifier configurations accepting in-toto attestations.
Impact	CVSS 7.5 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: None.
Exploit ScenarioDerived	An attacker could exploit this vulnerability to compromise the affected system.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Sigstore-ruby versions before 0.2.3 fail to properly validate artifact digests when verifying DSSE bundles with in-toto attestations, causing the library to incorrectly return successful verification even when the artifact does not match the attested subject. This allows attackers to bypass cryptographic verification controls and accept mismatched or tampered artifacts as valid. Organizations using sigstore-ruby for supply chain verification should upgrade to version 0.2.3 immediately, though no patch is currently available for other affected projects.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 21:55 CVSS 7.5

sigstore-ruby is a pure Ruby implementation of the sigstore verify command from the sigstore/cosign project. versions up to 0.2.3 is affected by unchecked return value (CVSS 7.5).

RemediationAI

Fixed in version 0.2.3.. Restrict network access to the affected service where possible.

Affected Packages

rubygems sigstore fix: 0.2.3

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in rubygems

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This vulnerability (CWE-252: Unchecked Return Value) affects sigstore-ruby is a pure Ruby implementation of the sigstore verify command from the sigstore/cosign project.. sigstore-ruby is a pure Ruby implementation of the sigstore verify command from the sigstore/cosign project. Prior to 0.2.3, Sigstore::Verifier#verify does not propagate the VerificationFailure returned by verify_in_toto when the artifact digest does not match the digest in the in-toto attestation subject. As a result, verification of DSSE bundles containing in-toto statements returns VerificationSuccess regardless of whether the artifact matches the attested subject. This vulnerability is fixed

Know when Sigstore gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

CVE Published

Mar 10, 2026 - 22:16 nvd

HIGH 7.5

DescriptionGitHub Advisory

sigstore-ruby is a pure Ruby implementation of the sigstore verify command from the sigstore/cosign project. Prior to 0.2.3, Sigstore::Verifier#verify does not propagate the VerificationFailure returned by verify_in_toto when the artifact digest does not match the digest in the in-toto attestation subject. As a result, verification of DSSE bundles containing in-toto statements returns VerificationSuccess regardless of whether the artifact matches the attested subject. This vulnerability is fixed in 0.2.3.

Executive ViewAI

Why It Matters

A critical vulnerability in sigstore-ruby (CVE-2026-31830) allows attackers to bypass cryptographic signature verification for software artifacts, meaning malicious or tampered code could be incorrectly validated as legitimate. Any organization using sigstore-ruby for supply chain security or artifact verification is at immediate risk of accepting compromised software components.

Business Impact: High

Compensating Controls

Disable DSSE bundle verification functionality in sigstore-ruby until patch availability; implement manual cryptographic verification of critical artifacts outside the vulnerable library; enforce network segmentation to restrict artifact sources to trusted internal registries only; require dual approval for any artifact deployments from external sources; monitor and log all verification operations for forensic analysis; consider alternative verification mechanisms (cosign CLI with verified binary) until patched Ruby library is available.

Threat Intelligence Overview

EPSS Score

0.0%

Top 92% exploitable

Data Quality

5 sources

Confidence: Medium

NVD

CVE.org

EPSS

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.