sigstore-go fails to check signature timestamps against a signing key's validity period

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-54787 · Microsoft / collected KEV context

GHSA-wqqc-jjcq-vfxm

GO-2026-6162

cve-program · CVE-2026-54787

• https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm
• https://github.com/sigstore/sigstore-go/pull/642
• https://github.com/sigstore/sigstore-go/commit/4594ab4c779d08be1f4419803a8249188f35ed5f
• https://github.com/sigstore/sigstore-go/releases/tag/v1.2.1

nvd · CVE-2026-54787

• https://github.com/sigstore/sigstore-go/commit/4594ab4c779d08be1f4419803a8249188f35ed5f
• https://github.com/sigstore/sigstore-go/pull/642
• https://github.com/sigstore/sigstore-go/releases/tag/v1.2.1
• https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm

osv · GHSA-wqqc-jjcq-vfxm

• https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm
• https://github.com/sigstore/sigstore-go/pull/642
• https://github.com/sigstore/sigstore-go/commit/4594ab4c779d08be1f4419803a8249188f35ed5f
• https://github.com/sigstore/sigstore-go
• https://github.com/sigstore/sigstore-go/releases/tag/v1.2.1

osv · GO-2026-6162

• https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm
• https://github.com/sigstore/sigstore-go/commit/4594ab4c779d08be1f4419803a8249188f35ed5f
• https://github.com/sigstore/sigstore-go/pull/642
• https://github.com/sigstore/sigstore-go/releases/tag/v1.2.1

No related operational record is retained in the current change model.