CVE-2026-128036
Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: 7fefd608-56a6-419f-a002-fd8543c0710a

Description
In gittuf 0.4.0 through 0.16.0, when a policy update appears within the range of reference state log entries being verified, verification checks only the root of trust signatures of the new policy and not the signatures of its other metadata (rule files). A user trusted to push to the repository who bypasses gittuf policy apply and writes the policy reference and reference state log directly can make an invalid policy apply during verification, weakening or strengthening the rules for later changes. The update is still recorded in the reference state log.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-128036
EUVD
EUVD-2026-125439

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gittuf gittuf From 0.4.0 (inc) to 0.17.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-128036 affects gittuf versions 0.4.0 through 0.16.0. It allows invalid policies to be trusted during verification if the normal policy update workflow is bypassed. Normally, policies are staged and validated before application, but an attacker with write access can push an invalid policy directly by modifying the policy reference and reference state log (RSL). During verification, gittuf checks a range of RSL entries but fails to fully validate intermediate policy updates, only verifying root of trust signatures and not other metadata files.

Impact Analysis

This vulnerability allows an attacker with write access to a repository to push an invalid policy that weakens or strengthens existing rules arbitrarily. However, all changes including invalid policies are recorded in the RSL and can be detected later. Exploitation requires high privileges and the impact is limited by the fact that changes are traceable.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-128036. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...