Junglewise Threat Intelligence
CVE-2026-24122: GO-2026-4529 - Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigsto
CVE-2026-24122 · Severity: low · CVSS 3.1 · Published 2026-02-23
Technologies: github.com/sigstore/cosign (Go), github.com/sigstore/cosign/v2 (Go), github.com/sigstore/cosign/v3 (Go). Vendors: Go.
Executive brief
Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign
Affected products
- Go github.com/sigstore/cosign
- Go github.com/sigstore/cosign/v2
- Go github.com/sigstore/cosign/v3