Vulnerability · Published Aug 12, 2026 · Assigned by GitHub_M
CVE-2026-48791Sigstore Java has a vulnerability with bundle verification of integratedTime
Low 2.0
In plain English
A low-severity security flaw in sigstore-java from sigstore. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 0% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated (Rekor entry) time) against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verification spec. The old sigstore-conformance test for this check was built incorrectly. This vulnerability impacts only users verifying bundles with `dev.sigstore:sigstore-java:2.0.0`. Older versions are not affected; it is fixed in `dev.sigstore:sigstore-java:2.1.0` A malicious actor may exploit this if they were able to access a users system and exfiltrate the temporary private key used during signing and then reuse an old fulcio certificate later without requiring direct access to the user's credentials. Users may protect themselves by re-verifying their artifacts using the newest sigstore-java or another current sigstore client. Transparency logs may also be audited for unauthorized signatures for a suspected reused identity.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | dev.sigstore:sigstore-java | 2.1.0 | GHSA-qqw8-7c2r-jxch |
| Ubuntu:24.04:LTS | golang-github-sigstore-sigstore | no fix listed | UBUNTU-CVE-2026-48791 |
| Ubuntu:26.04:LTS | golang-github-sigstore-sigstore | no fix listed | UBUNTU-CVE-2026-48791 |
| Ubuntu:26.10 | golang-github-sigstore-sigstore | no fix listed | UBUNTU-CVE-2026-48791 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| sigstore | sigstore-java | = 2.0.0 |
Weakness: CWE-347 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
References
- https://github.com/sigstore/sigstore-java/security/advisories/GHSA-qqw8-7c2r-jxch x_refsource_CONFIRM
- https://github.com/sigstore/sigstore-java/pull/1008 x_refsource_MISC
- https://github.com/sigstore/sigstore-java/pull/1185 x_refsource_MISC
- https://github.com/sigstore/sigstore-java/commit/4b7a49ebb1813f5b1ff113bcad63246358222d61 x_refsource_MISC
- https://github.com/sigstore/sigstore-java/commit/b529335728fc5cfb574161b4b3c06859a8a2aa88 x_refsource_MISC