Is CVE-2026-48815 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48815 being exploited in the wild.

How severe is CVE-2026-48815?

High severity, with a CVSS score of 7.5, published 14 July 2026.

Which products and versions are affected?

sigstore (npm) <= 4.1.0, SEMVER:introduced=0,fixed=4.1.1; Sigstore-Js < 4.1.1, <= 4.1.0, ≤4.1.0.

Is there a fix for CVE-2026-48815?

Yes. sigstore (npm): upgrade to 4.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48815 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-48815?

Check whether you run sigstore (npm) or Sigstore-Js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48815: sigstore-js improper verification of certificate OIDs

Q: Which products and versions are affected?

sigstore (npm) <= 4.1.0, SEMVER:introduced=0,fixed=4.1.1; Sigstore-Js < 4.1.1, <= 4.1.0, ≤4.1.0.

Q: Is there a fix for CVE-2026-48815?

Yes. sigstore (npm): upgrade to 4.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-48815 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-48815?

Check whether you run sigstore (npm) or Sigstore-Js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48815 · Severity: high · CVSS 7.5 · Published 2026-07-14

sigstore is a code-signing solution used to verify the authenticity and integrity of software artifacts. A bug in its verification logic silently ignores certificate extension constraints (OIDs) that developers explicitly configure, allowing unauthorized certificates to pass validation as long as other checks pass. This bypasses intentional access controls, potentially allowing malicious or unauthorized signers to have their signatures accepted.

Technologies: Sigstore-Js. Vendors: npm, Sigstore.

Quick answers

Is CVE-2026-48815 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48815 being exploited in the wild.
How severe is CVE-2026-48815?: High severity, with a CVSS score of 7.5, published 14 July 2026.
Which products and versions are affected?: sigstore (npm) <= 4.1.0, SEMVER:introduced=0,fixed=4.1.1; Sigstore-Js < 4.1.1, <= 4.1.0, ≤4.1.0.
Is there a fix for CVE-2026-48815?: Yes. sigstore (npm): upgrade to 4.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48815 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-48815?: Check whether you run sigstore (npm) or Sigstore-Js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

sigstore (npm): upgrade to 4.1.1 or later
```
npm install sigstore@4.1.1
```

Technical details

The vulnerability is an improper cryptographic signature verification flaw (CWE-347) in sigstore's policy-construction path. The public verify API includes a certificateOIDs option documented to restrict verification to certificates carrying specific Object Identifiers (OIDs) in their extensions. However, the createVerificationPolicy() function only copies SAN and issuer settings into the internal verification policy and completely ignores the certificateOIDs parameter. As a result, any certificate bundle satisfying the remaining checks (issuer, identity) is accepted even if required OID extensions are absent or mismatched. This is reachable through supported, documented API usage. The vulnerability affects sigstore versions ≤4.1.0 and was fixed in version 4.1.1. No authentication or user interaction is required; exploitation is network-reachable.

Affected products

sigstore sigstore-js ≤4.1.0

Identifiers

CVE-2026-48815
GHSA-52v5-jr5w-gjxr

Timeline

2026-07-01: disclosed: Advisory published
2026-07-01: patched: Fix available in version 4.1.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.