CVE catalog

CVE-2026-24122

Cosign provides code signing and transparency for containers and binaries. In versions 3.0.4 and below, an issuing certificate with a validity that expires before the leaf certificate will be consider

[CVE catalog]

Severity
Low · CVSS 3.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.21% · Oct 25, 2026

A flaw was found in sigstore/cosign. This vulnerability affects private deployments using customized Public Key Infrastructures (PKIs), where it can lead to incorrect validation of artifact signatures. Cosign may mistakenly accept an issuing certificate as valid even if its expiration date precedes the leaf certificate's, potentially allowing invalid signatures to be trusted. This could compromise the integrity of signature verification in affected environments. sigstore/cosign: sigstore/cosign: Incorrect signature validation due to expired issuing certificate bypass The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Gogithub.com/sigstore/cosignNot reported3.0.5fixed
CpecosignNot reportedNot reportedunknown
Debiancosign132.5.0-2vulnerable
Debiancosign132.6.2-1vulnerable
Debiancosign132.6.2-1~exp0vulnerable
Debiancosign132.6.3-1vulnerable
Debiancosign133.0.5-1~exp0vulnerable
Debiancosign133.0.6-1vulnerable
Debiancosign133.0.6-1~exp0vulnerable
Debiancosign133.1.0-1~exp0vulnerable
Debiancosign133.1.1-1vulnerable
Debiancosign133.1.1-1~exp0vulnerable
Debiancosign142.5.0-2vulnerable
Debiancosign142.6.2-1vulnerable
Debiancosign142.6.2-1~exp0vulnerable
Debiancosign142.6.3-1vulnerable
Debiancosign143.0.5-1~exp0vulnerable
Debiancosign143.0.6-1~exp0vulnerable
Debiancosign143.0.6-1fixed
Opensusetrivyleap 16.00.74.0-160000.2.1fixed
Opensusetrivytumbleweed0.74.0-2.1fixed
Opensusehaulertumbleweed1.4.2-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Gogithub.com/sigstore/cosigngoNot reported3.0.5Not reportedNot reportedNot reported
Debiancosigndeb143.0.6-1Not reportedDEBIAN-CVE-2026-24122Not reported
Opensusetrivyrpmleap 16.00.74.0-160000.2.1Not reportedOPENSUSE-SU-2026:21801-1Not reported
Opensusetrivyrpmtumbleweed0.74.0-2.1Not reportedOPENSUSE-SU-2026:11676-1Not reported
Opensusehaulerrpmtumbleweed1.4.2-1.1Not reportedOPENSUSE-SU-2026:10635-1Not reported

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [cosign]Affected

    Source package: [cosign]

    Details (2)

    • 2.5.0-2+b4 · amd64 · trixie

      Affected

      nvd · cosign · debian · 13

    • 2.5.0-2+b4 · arm64 · trixie

      Affected

      nvd · cosign · debian · 13

  • [golang-github-sigstore-cosign-dev]Affected

    Source package: [cosign]

    Details (2)

    • 2.5.0-2 · all · trixie

      Affected

      nvd · cosign · debian · 13

    • 2.5.0-2 · all · trixie

      Affected

      nvd · cosign · debian · 13

[openSUSE Tumbleweed]

  • [trivy]Affected

    Source package: [trivy]

    Details (1)

    • 0.74.0-1.1 · x86_64 · tumbleweed

      Affected · Fixed: 0.74.0-2.1

      nvd · trivy · opensuse · tumbleweed

  • [hauler]Fixed

    Source package: [hauler]

    Details (1)

    • 2.0.3-1.1 · x86_64 · tumbleweed

      Fixed · Fixed: 1.4.2-1.1

      nvd · hauler · opensuse · tumbleweed

Observed:

References

[FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]