Vulnerability in dev.sigstore:sigstore-java (CVE-2026-48791)
Summary
Vulnerability in dev.sigstore:sigstore-java (CVE-2026-48791). Risk of unauthorized operations or information disclosure. Exploitable via integratedTime. Mitigation: upgrade to 2.1.0 or later.
Original description
The description as published by the source.
Summary
Regression: Verification of integratedTime from Rekor V1 Log Entry against Fuclio Certificate validity was missing
Details
- PR #1008 erroneously removed verification of the integrated (Rekor entry) time) against the Fulcio certificate.
- PR #1185 re-added this verification with enhancements that adhere to the Sigstore verification spec.
- old sigstore-conformance test for this check was built incorrectly
PoC
A new bundle was added to sigstore-conformance to test this: sigstore-java:2.0.0 can be tested against it and shown to be unexpectedly passing
Verify this bundle against a.txt
$ git clone git@github.com:sigstore/sigstore-java
$ git checkout v2.0.0
$ ./gradlew :sigstore-cli:build
$ tar -xf sigstore-cli/build/distributions/sigstore-cli-*-SNAPSHOT.tar --strip-components 1
$ ./bin/sigstore-cli verify --bundle=bundle.sigstore.json a.txt
# expect error but none
Impact
This vulnerability impacts only users verifying bundles with dev.sigstore:sigstore-java:2.0.0. Older versions are not affected, it is fixed in `dev.sigstore:sigstore-java:…
Source: GitHub Security Advisories (Global) NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-48791 has been found in dev.sigstore:sigstore-java.
Attackers can target a specific entry point like integratedTime over the network to misuse the product.
Risk of unauthorized operations or information disclosure. CVSS score: 2.0/10.
What to do: upgrade dev.sigstore:sigstore-java to 2.1.0 or later.
If unsure, ask your IT team or search "dev.sigstore:sigstore-java CVE-2026-48791" on the vendor's site.
CVE-2026-48791 (dev.sigstore:sigstore-java) — CWE-347 / CVSS v3 2.0
Attack vector: local
Attack surface: integratedTime / a.txt
Patched: 2.1.0 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-347) exists in dev.sigstore:sigstore-java. Attackers reach the vulnerable code path via integratedTime.
Check the vendor advisory for the affected versions of dev.sigstore:sigstore-java. Attack surface: integratedTime / a.txt.
Severity: Low (CVSS 2.0/10). Risk of unauthorized operations or information disclosure.
Update to 2.1.0.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Audit SBOM/dependencies to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
Audit SBOM/dependencies for affected components.資産台帳・SBOM・依存マニフェストで dev.sigstore:sigstore-java を使っているサービスとバージョンを洗い出す。
-
2Apply patch patch
Upgrade dev.sigstore:sigstore-java to 2.1.0ステージング環境で 2.1.0 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
3Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Ubuntu UBUNTU-CVE-2026-48791 golang-github-sigstore-sigstore
References
- package github.com
- web github.com
- web security-advisories@github.com
- web security-advisories@github.com
- web security-advisories@github.com
- web security-advisories@github.com
- web github.com