Executive brief
Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign
Affected products
- Go github.com/sigstore/cosign
- Go github.com/sigstore/cosign/v2
- Go github.com/sigstore/cosign/v3
Junglewise Threat Intelligence
CVE-2026-22703: GO-2026-4309 - Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign
CVE-2026-22703 · Severity: low · CVSS 3.1 · Published 2026-01-13
Technologies: github.com/sigstore/cosign (Go), github.com/sigstore/cosign/v2 (Go), github.com/sigstore/cosign/v3 (Go). Vendors: Go.
Related threats
- Sigstore Cosign validation bypass in verify-blob-attestation
- GO-2026-4529 - Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigsto
- GO-2024-2719 - Cosign malicious artifacts can cause machine-wide DoS in github.com/sigstore/cosign
- GO-2024-2718 - Cosign malicious attachments can cause system-wide denial of service in github.com/sigstore/cosign
- GO-2022-0998 - Improper blob verification in github.com/sigstore/cosign