# CVE-2026-49834: Sigstore sigstore-go multi-log threshold bypass

Source: https://junglewise.ai/threats/cve-2026-49834-sigstore-sigstore-go-multi-log-threshold-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-17. Updated: 2026-07-17  
License: CC BY 4.0 with a link back

CVE-2026-49834 · Severity: medium · CVSS 5.9 · Published 2026-07-17

sigstore-go is a software library used to verify the digital signatures and authenticity of software packages. A flaw in how the library counts security 'witnesses' allows a single compromised log server to trick the system into thinking multiple independent servers have verified a signature. This undermines the 'multi-log' security policy, potentially allowing an attacker who has compromised one log to bypass protections intended to require consensus from several different authorities.

Technologies: [github.com/sigstore/sigstore-go (Go)](https://junglewise.ai/threats/technologies/github-com-sigstore-sigstore-go). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Sigstore](https://junglewise.ai/threats/vendors/sigstore).

## Quick answers

**Is CVE-2026-49834 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49834 being exploited in the wild.

**How severe is CVE-2026-49834?** Medium severity, with a CVSS score of 5.9, published 17 July 2026.

**Which products and versions are affected?** github.com/sigstore/sigstore-go (Go) <= 1.1.4, SEMVER:introduced=0,fixed=1.2.0; Sigstore-Go < 1.2.0, <= 1.1.4.

**Is there a fix for CVE-2026-49834?** Yes. github.com/sigstore/sigstore-go (Go): upgrade to 1.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-49834 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-49834?** Check whether you run github.com/sigstore/sigstore-go (Go) or Sigstore-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/sigstore/sigstore-go (Go): upgrade to 1.2.0 or later

  ```sh
  go get github.com/sigstore/sigstore-go@v1.2.0
  ```


## Technical details

A vulnerability exists in sigstore-go's verification logic when configured with WithTransparencyLog(N>1) or WithSignedCertificateTimestamps(N>1). The library incorrectly counts verified witnesses per entry or per validation path instead of per unique log authority. Consequently, a single compromised transparency log can forge multiple entries with different indices, or a compromised Certificate Transparency (CT) log can provide multiple Signed Certificate Timestamps (SCTs) to satisfy the threshold N. This allows an attacker to defeat multi-log enforcement policies designed for defense-in-depth. The issue is resolved in version 1.2.0 by ensuring each distinct log identity counts as at most one witness.

## Affected products

- sigstore sigstore-go < 1.2.0

## Identifiers

- CVE-2026-49834
- GHSA-9vcr-p3rj-q5q6
- GO-2026-5952

## Timeline

- 2026-05-27: patched: Fix merged into main branch via PR #633
- 2026-06-03: advisory: Release v1.2.0 published
- 2026-07-17: disclosed: CVE-2026-49834 published

## References

- [https://github.com/sigstore/sigstore-go/commit/dbb07e62623edd5b175fb9dd5a41dcb85a159207](https://github.com/sigstore/sigstore-go/commit/dbb07e62623edd5b175fb9dd5a41dcb85a159207)
- [https://github.com/sigstore/sigstore-go/pull/633](https://github.com/sigstore/sigstore-go/pull/633)
- [https://github.com/sigstore/sigstore-go/releases/tag/v1.2.0](https://github.com/sigstore/sigstore-go/releases/tag/v1.2.0)
- [https://github.com/sigstore/sigstore-go/security/advisories/GHSA-9vcr-p3rj-q5q6](https://github.com/sigstore/sigstore-go/security/advisories/GHSA-9vcr-p3rj-q5q6)

## Related threats

- [sigstore-go expired key usage in self-managed signing workflow](https://junglewise.ai/threats/cve-2026-54787-sigstore-go-expired-key-usage-in-self-managed-signing-workflow)
- [sigstore-go has an unbounded loop over untrusted input can lead to endless data attack](https://junglewise.ai/threats/cve-2024-45395-sigstore-go-has-an-unbounded-loop-over-untrusted-input-can-lead)