Is CVE-2026-48791 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48791 being exploited in the wild.

How severe is CVE-2026-48791?

Low severity, with a CVSS score of 3.1, published 13 August 2026.

Which products and versions are affected?

dev.sigstore:sigstore-java (Maven) = 2.0.0, ECOSYSTEM:introduced=2.0.0,fixed=2.1.0; Sigstore-Java 2.0.0.

Is there a fix for CVE-2026-48791?

Yes. dev.sigstore:sigstore-java (Maven): upgrade to 2.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48791 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-48791?

Check whether you run dev.sigstore:sigstore-java (Maven) or Sigstore-Java at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48791: Sigstore Java improper signature verification in KeylessVerifier

CVE-2026-48791 · Severity: low · CVSS 3.1 · Published 2026-08-13

Sigstore Java, a library used for verifying the authenticity of software artifacts, contains a flaw where it fails to properly check the timing of digital signatures against security certificates. In practice, this could allow a malicious actor who has previously stolen a user's temporary signing key to reuse an old, expired certificate to sign new files without authorization. This undermines the security guarantees of the signing process, potentially allowing unauthorized software to appear as if it were legitimately signed.

Technologies: dev.sigstore:sigstore-java (Maven). Vendors: Maven, Sigstore.

Quick answers

Is CVE-2026-48791 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48791 being exploited in the wild.
How severe is CVE-2026-48791?: Low severity, with a CVSS score of 3.1, published 13 August 2026.
Which products and versions are affected?: dev.sigstore:sigstore-java (Maven) = 2.0.0, ECOSYSTEM:introduced=2.0.0,fixed=2.1.0; Sigstore-Java 2.0.0.
Is there a fix for CVE-2026-48791?: Yes. dev.sigstore:sigstore-java (Maven): upgrade to 2.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48791 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-48791?: Check whether you run dev.sigstore:sigstore-java (Maven) or Sigstore-Java at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

dev.sigstore:sigstore-java (Maven): upgrade to 2.1.0 or later

# set dev.sigstore:sigstore-java to 2.1.0 in your pom.xml or build.gradle

Technical details

A regression in sigstore-java version 2.0.0, introduced in PR #1008, removed the mandatory verification of the 'integratedTime' from Rekor V1 Log Entries against the validity window of Fulcio certificates. This violates the Sigstore verification specification, which requires that the time of entry into the transparency log falls within the certificate's lifetime. An attacker with access to a previously exfiltrated temporary private key could exploit this to sign artifacts using an old certificate that should no longer be trusted. The issue is resolved in version 2.1.0 by re-implementing the integrated time check in the KeylessVerifier component.

Affected products

sigstore sigstore-java 2.0.0

Identifiers

CVE-2026-48791
GHSA-qqw8-7c2r-jxch

Timeline

2025-07-17: other: Vulnerability introduced in PR #1008
2026-05-07: patched: Fix merged in PR #1185
2026-05-26: disclosed
2026-06-30: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.