CVE-2026-54787
Received Received - Intake

Sigstore-go Timestamp Validation Bypass in Key Wrapping

Publication date: 2026-07-31

Last updated on: 2026-08-01

Assigner: GitHub, Inc.

Description
sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired key material to sign accepted bundles. This issue is fixed in version 1.2.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-31
Last Modified
2026-08-01
Generated
2026-08-01
AI Q&A
2026-08-01
EPSS Evaluated
N/A
NVD
CVE-2026-54787

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sigstore sigstore-go to 1.2.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-324 The product uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing window for cracking attacks against that key.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

sigstore-go is a Go library for Sigstore signing and verification. Prior to version 1.2.1, it fails to verify if a bundle signing timestamp is within the validity period of an ExpiringKey wrapping a long-lived signing key without a certificate. This allows attackers with expired key material to sign bundles that are still accepted.

Detection Guidance

This vulnerability can be detected by checking if your system uses sigstore-go versions prior to 1.2.1. Run the command: go list -m github.com/sigstore/sigstore-go@v* to check the installed version. If the version is less than 1.2.1, the system is vulnerable.

Impact Analysis

If you use sigstore-go versions before 1.2.1, an attacker could use expired key material to create seemingly valid signed bundles. This could lead to unauthorized or tampered software being accepted as legitimate, potentially compromising the integrity of signed artifacts.

Compliance Impact

This vulnerability may impact compliance by allowing unauthorized or altered software to be treated as valid. For GDPR, this could affect data integrity controls. For HIPAA, it might compromise software integrity in healthcare systems. Organizations must ensure all signed artifacts are verified correctly to maintain compliance.

Mitigation Strategies

Update sigstore-go to version 1.2.1 or later to address the missing timestamp validation issue. Review any long-lived signing keys without certificates to ensure they are properly managed and not expired.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54787. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart