What is the CVSS score of CVE-2026-31830?

CVE-2026-31830 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Sigstore are affected by CVE-2026-31830?

A critical vulnerability in sigstore-ruby (CVE-2026-31830) allows attackers to bypass cryptographic signature verification for software artifacts, meaning malicious or tampered code could be…. A patch is available.

How to fix or mitigate CVE-2026-31830?

Within 24 hours: Identify all systems and applications using sigstore-ruby and document their criticality; notify development and security teams of the vulnerability. Within 7 days: Implement compensating controls by disabling DSSE bundle verification until patches are available, or isolate affected systems from production environments; conduct code review of any recent artifact verifications. Within 30 days: Monitor sigstore-ruby project releases for version 0.2.3 or later; plan and execute upgrade once patch is available; validate verification logic post-upgrade with test artifacts.

Sigstore CVE-2026-31830

HIGH

Unchecked Return Value (CWE-252)

2026-03-10 security-advisories@github.com

GHSA-mhg6-2q2v-9h2c

Information Disclosure Sigstore

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 10, 2026 - 22:16 nvd

HIGH 7.5

DescriptionGitHub Advisory

sigstore-ruby is a pure Ruby implementation of the sigstore verify command from the sigstore/cosign project. Prior to 0.2.3, Sigstore::Verifier#verify does not propagate the VerificationFailure returned by verify_in_toto when the artifact digest does not match the digest in the in-toto attestation subject. As a result, verification of DSSE bundles containing in-toto statements returns VerificationSuccess regardless of whether the artifact matches the attested subject. This vulnerability is fixed in 0.2.3.

AnalysisAI

Sigstore-ruby versions before 0.2.3 fail to properly validate artifact digests when verifying DSSE bundles with in-toto attestations, causing the library to incorrectly return successful verification even when the artifact does not match the attested subject. This allows attackers to bypass cryptographic verification controls and accept mismatched or tampered artifacts as valid. Organizations using sigstore-ruby for supply chain verification should upgrade to version 0.2.3 immediately, though no patch is currently available for other affected projects.

Technical ContextAI

This vulnerability (CWE-252: Unchecked Return Value) affects sigstore-ruby is a pure Ruby implementation of the sigstore verify command from the sigstore/cosign project.. sigstore-ruby is a pure Ruby implementation of the sigstore verify command from the sigstore/cosign project. Prior to 0.2.3, Sigstore::Verifier#verify does not propagate the VerificationFailure returned by verify_in_toto when the artifact digest does not match the digest in the in-toto attestation subject. As a result, verification of DSSE bundles containing in-toto statements returns VerificationSuccess regardless of whether the artifact matches the attested subject. This vulnerability is fixed