CVE-2026-54787 Details
Description
sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired key material to sign accepted bundles. This issue is fixed in version 1.2.1.
A vulnerability in the Sigstore-Go library prior to version 1.2.1 allows expired key materials to be used for signing bundles. This issue arises because the library fails to verify the signing timestamp against the validity period of an ExpiringKey that wraps a self-managed, long-lived signing key without a certificate. As a result, an attacker with expired key material could potentially sign bundles that are accepted despite the keys being out of date. This vulnerability specifically impacts workflows using long-lived signing keys, not standard deployments with a certificate authority.
Users can upgrade to Sigstore-Go version 1.2.1 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-324 | Use of a Key Past its Expiration Date | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 1, 2026 | CVE Modified | CISA-ADP |
| Jul 31, 2026 | New CVE Received | [email protected] |