CVE-2026-48791
Received Received - Intake

Verification Bypass in Sigstore Java Client

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description
sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated (Rekor entry) time) against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verification spec. The old sigstore-conformance test for this check was built incorrectly. This vulnerability impacts only users verifying bundles with `dev.sigstore:sigstore-java:2.0.0`. Older versions are not affected; it is fixed in `dev.sigstore:sigstore-java:2.1.0` A malicious actor may exploit this if they were able to access a users system and exfiltrate the temporary private key used during signing and then reuse an old fulcio certificate later without requiring direct access to the user's credentials. Users may protect themselves by re-verifying their artifacts using the newest sigstore-java or another current sigstore client. Transparency logs may also be audited for unauthorized signatures for a suspected reused identity.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-48791

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
dev.sigstore sigstore-java 2.0.0
dev.sigstore sigstore-java 2.1.0
dev.sigstore sigstore-java From 2.0.0 (inc) to 2.1.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-347 The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-48791 is a vulnerability in sigstore-java version 2.0.0 where verification of the integrated time from a Rekor V1 Log Entry against the Fulcio certificate was missing due to a regression. This allowed malicious actors with access to a temporary private key to reuse an old Fulcio certificate without needing direct credentials.

Detection Guidance

This vulnerability affects only sigstore-java version 2.0.0. To detect it, check your installed version with: mvn dependency:tree | grep sigstore-java. If version 2.0.0 is present, the system is vulnerable.

Impact Analysis

This vulnerability could allow an attacker with local system access and high privileges to reuse an old Fulcio certificate if they obtained a temporary private key. It does not directly expose credentials but may lead to unauthorized artifact signing or verification.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it pertains to a specific software library (sigstore-java) and its verification process. The issue involves missing verification of integrated time against Fulcio certificates, which could allow misuse of old certificates if a temporary private key is compromised. Compliance with standards like GDPR or HIPAA would depend on broader system implementations rather than this specific vulnerability.

Mitigation Strategies

Upgrade sigstore-java to version 2.1.0 or later. Re-verify all previously signed artifacts using the updated client. Audit transparency logs for unauthorized signatures using old Fulcio certificates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48791. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart