{"id":"CVE-2026-54787","sourceIdentifier":"security-advisories@github.com","published":"2026-07-31T23:17:25.287","lastModified":"2026-10-23T23:10:00.157","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired key material to sign accepted bundles. This issue is fixed in version 1.2.1."},{"lang":"es","value":"sigstore-go es una biblioteca Go para la firma y verificación de Sigstore. Antes de la versión 1.2.1, sigstore-go no verifica una marca de tiempo de firma de paquete contra la ventana de validez de una ExpiringKey que envuelve una clave de firma de larga duración autogestionada sin un certificado, lo que puede permitir a un atacante que posee material de clave caducado firmar paquetes aceptados. Este problema está solucionado en la versión 1.2.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"sigstore","product":"sigstore-go","versions":[{"version":"< 1.2.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":3.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-31T23:35:40.966529Z","id":"CVE-2026-54787","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-324"}]}],"references":[{"url":"https://github.com/sigstore/sigstore-go/commit/4594ab4c779d08be1f4419803a8249188f35ed5f","source":"security-advisories@github.com"},{"url":"https://github.com/sigstore/sigstore-go/pull/642","source":"security-advisories@github.com"},{"url":"https://github.com/sigstore/sigstore-go/releases/tag/v1.2.1","source":"security-advisories@github.com"},{"url":"https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm","source":"security-advisories@github.com"},{"url":"https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}