DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-54787: CVE-2026-54787: Insufficient Timestamp Validation in sigstore-go Key Verification Path

#security #cve #cybersecurity

CVE-2026-54787: Insufficient Timestamp Validation in sigstore-go Key Verification Path

Vulnerability ID: CVE-2026-54787
CVSS Score: 3.1
Published: 2026-07-31

A security vulnerability in sigstore-go prior to version 1.2.1 allowed the use of expired or retired self-managed long-lived public keys wrapped in an ExpiringKey configuration to successfully sign code or artifacts. Because the verification pipeline verified the cryptographic signatures and RFC 3161 timestamps but failed to perform a temporal boundary check on the public key's validity window, verifiers running affected versions would mistakenly accept signatures produced outside of the key's designated operational lifetime.

TL;DR

Prior to version 1.2.1, sigstore-go failed to validate signature timestamps against the validity window of self-managed long-lived public keys wrapped in an ExpiringKey configuration. This allowed an attacker with expired or rotated key material to generate accepted signed bundles, effectively bypassing key rotation policies and breaking cryptographic trust guarantees.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-324
  • Attack Vector: Network
  • CVSS: 3.1 (Low)
  • EPSS Score: Not Available
  • Impact: Partial Integrity Compromise
  • Exploit Status: PoC (Proof-of-Concept) inside official repository
  • KEV Status: Not Listed

Affected Systems

  • sigstore-go
  • sigstore-go: < 1.2.1 (Fixed in: 1.2.1)

Code Analysis

Commit: 4594ab4

Fix verification of signed entity timestamps against public key validity windows

Exploit Details

  • GitHub Advisory: Details the verification vulnerability and references the testing bundles.

Mitigation Strategies

  • Upgrade sigstore-go dependency to version 1.2.1 or higher.
  • Ensure verification policies explicitly require at least one verified signed timestamp using verify.WithSignedTimestamps(1) or equivalent.
  • Avoid utilizing verify.WithNoObserverTimestamps() when validating key-signed bundles.

Remediation Steps:

  1. Open your project's terminal and execute the update command: go get github.com/sigstore/sigstore-go@v1.2.1
  2. Run go mod tidy to update the go.mod and go.sum configuration files.
  3. Review initialization parameters for verify.NewVerifier and verify.NewPolicy to confirm that timestamp checking is not bypassed.
  4. Recompile and redeploy the verification binaries to your target systems.

References

Read the full report for CVE-2026-54787 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)