Is CVE-2026-49834 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-49834 being exploited in the wild.

How severe is CVE-2026-49834?

Medium severity, with a CVSS score of 5.9, published 17 July 2026.

Which products and versions are affected?

github.com/sigstore/sigstore-go (Go) <= 1.1.4, SEMVER:introduced=0,fixed=1.2.0; Sigstore-Go < 1.2.0, <= 1.1.4.

Is there a fix for CVE-2026-49834?

Yes. github.com/sigstore/sigstore-go (Go): upgrade to 1.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-49834 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-49834?

Check whether you run github.com/sigstore/sigstore-go (Go) or Sigstore-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49834: Sigstore sigstore-go multi-log threshold bypass

Q: Is there a fix for CVE-2026-49834?

Yes. github.com/sigstore/sigstore-go (Go): upgrade to 1.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-49834 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-49834?

Check whether you run github.com/sigstore/sigstore-go (Go) or Sigstore-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49834 · Severity: medium · CVSS 5.9 · Published 2026-07-17

sigstore-go is a software library used to verify the digital signatures and authenticity of software packages. A flaw in how the library counts security 'witnesses' allows a single compromised log server to trick the system into thinking multiple independent servers have verified a signature. This undermines the 'multi-log' security policy, potentially allowing an attacker who has compromised one log to bypass protections intended to require consensus from several different authorities.

Technologies: github.com/sigstore/sigstore-go (Go). Vendors: Go, Sigstore.

Quick answers

Is CVE-2026-49834 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-49834 being exploited in the wild.
How severe is CVE-2026-49834?: Medium severity, with a CVSS score of 5.9, published 17 July 2026.
Which products and versions are affected?: github.com/sigstore/sigstore-go (Go) <= 1.1.4, SEMVER:introduced=0,fixed=1.2.0; Sigstore-Go < 1.2.0, <= 1.1.4.
Is there a fix for CVE-2026-49834?: Yes. github.com/sigstore/sigstore-go (Go): upgrade to 1.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49834 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-49834?: Check whether you run github.com/sigstore/sigstore-go (Go) or Sigstore-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/sigstore/sigstore-go (Go): upgrade to 1.2.0 or later
```
go get github.com/sigstore/sigstore-go@v1.2.0
```

Technical details

A vulnerability exists in sigstore-go's verification logic when configured with WithTransparencyLog(N>1) or WithSignedCertificateTimestamps(N>1). The library incorrectly counts verified witnesses per entry or per validation path instead of per unique log authority. Consequently, a single compromised transparency log can forge multiple entries with different indices, or a compromised Certificate Transparency (CT) log can provide multiple Signed Certificate Timestamps (SCTs) to satisfy the threshold N. This allows an attacker to defeat multi-log enforcement policies designed for defense-in-depth. The issue is resolved in version 1.2.0 by ensuring each distinct log identity counts as at most one witness.

Affected products

sigstore sigstore-go < 1.2.0

Identifiers

CVE-2026-49834
GHSA-9vcr-p3rj-q5q6
GO-2026-5952

Timeline

2026-05-27: patched: Fix merged into main branch via PR #633
2026-06-03: advisory: Release v1.2.0 published
2026-07-17: disclosed: CVE-2026-49834 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.