Vulnerability · Published Jul 17, 2026 · Assigned by GitHub_M

CVE-2026-49834sigstore-go: Multi-log threshold bypass via single compromised log

Medium 5.9

In plain English

A medium-severity security flaw in sigstore-go from sigstore. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.2%top 92.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.0, a verifier configured with WithTransparencyLog(N>1) or WithSignedCertificateTimestamps(N>1) counts verified witnesses per entry or per validation path rather than per log authority, allowing a single compromised transparency log or CT log to satisfy multi-log threshold requirements and defeat the multi-log policy. This issue is fixed in version 1.2.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:13	sigstore-go	no fix listed	DEBIAN-CVE-2026-49834
Debian:14	sigstore-go	1.2.1-1	DEBIAN-CVE-2026-49834
Go	github.com/sigstore/sigstore-go	1.2.0	GHSA-9vcr-p3rj-q5q6
Go	github.com/sigstore/sigstore-go	1.2.0	GO-2026-5952
Ubuntu:26.10	sigstore-go	no fix listed	UBUNTU-CVE-2026-49834

Affected products (as reported)

Vendor	Product	Versions
sigstore	sigstore-go	< 1.2.0

Weakness: CWE-347 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

References

https://github.com/sigstore/sigstore-go/security/advisories/GHSA-9vcr-p3rj-q5q6 x_refsource_CONFIRM
https://github.com/sigstore/sigstore-go/pull/633 x_refsource_MISC
https://github.com/sigstore/sigstore-go/commit/dbb07e62623edd5b175fb9dd5a41dcb85a159207 x_refsource_MISC
https://github.com/sigstore/sigstore-go/releases/tag/v1.2.0 x_refsource_MISC