Executive brief
Sigstore Cosign, a tool used to sign and verify the integrity of software containers and binaries, contains a flaw in how it validates certain security attestations. An attacker could provide a malformed or mismatched attestation that the tool incorrectly marks as 'Verified OK,' potentially leading users to trust unverified or incorrect software metadata. This issue affects the 'verify-blob-attestation' command and can be mitigated by updating to the latest version or ensuring specific claim-checking flags are enabled.
Technical details
A logic flaw in Sigstore Cosign's 'verify-blob-attestation' command leads to improper validation of attestation payloads. In older bundle formats and detached signatures, error handling during predicate type validation was flawed; in newer formats, the validation was bypassed entirely. This allows an attestation with a valid signature but a malformed payload or incorrect type to return a successful verification result if '--check-claims' is not set to true. Attackers can exploit this to bypass type-based rejection policies. The vulnerability is addressed in versions 3.0.6 and 2.6.3.
Affected products
- Sigstore Cosign < 2.6.3, >= 3.0.0, < 3.0.6
Timeline
- 2026-04-06: advisory: GitHub Security Advisory published
- 2026-04-07: disclosed: CVE-2026-39395 published