{"id":"CVE-2026-48815","title":"sigstore: Sigstore: Unauthorized certificates accepted due to ignored `certificateOIDs` verification option (CVE-2026-48815)","summary":"A flaw was found in sigstore. The `certificateOIDs` option, intended to restrict which certificates can sign artifacts, is accepted by the public application programming interface (API) but is not used during the verification process. This…","severity":"medium","cvss":5.9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","cvssSource":"vendor","cwe":["CWE-345","CWE-347"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","affected":["exploit_intelligence","connectivity_link 1","enterprise_linux 10","enterprise_linux 8","enterprise_linux 9","enterprise_linux_ai_rhel_ai 3"],"patched":["sigstore 4.1.1"],"published":"2026-07-01","updated":"2026-09-10","sourceUpdated":"2026-09-10T10:38:21+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48815.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48815.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-48815"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2499687"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48815"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48815"},{"url":"https://github.com/sigstore/sigstore-js/pull/1658/changes"},{"url":"https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr"},{"url":"https://github.com/advisories/GHSA-52v5-jr5w-gjxr"}],"tags":["csaf","vex","red-hat","ghsa","npm"],"epss":0.0019,"epssPercentile":0.08905,"ecosystem":"npm","scores":{"vendor":5.9,"ghsa":7.5},"ingestedAt":"2026-07-01T20:16:35.284Z","slug":"CVE-2026-48815","body":"## Overview\n\nA flaw was found in sigstore. The `certificateOIDs` option, intended to restrict which certificates can sign artifacts, is accepted by the public application programming interface (API) but is not used during the verification process. This allows unauthorized certificates to be accepted, bypassing security policies that rely on specific certificate extension object identifiers (OIDs). As a result, applications that depend on this option for security receive no protection, potentially leading to the acceptance of malicious or untrusted artifacts.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Exploit Intelligence, Red Hat Connectivity Link 1, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux AI (RHEL AI) 3 · no fix planned: Red Hat Connectivity Link 1, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, … · updated 2026-09-10 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48815.json)\n\n**sigstore: Sigstore: Unauthorized certificates accepted due to ignored `certificateOIDs` verification option** — rated Moderate by Red Hat. Released 2026-07-01, updated 2026-09-10.\n\nAffected:\n\n- Exploit Intelligence\n- Red Hat Connectivity Link 1\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n\nNo fix planned:\n\n- Red Hat Connectivity Link 1\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Exploit Intelligence\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n\nNot affected:\n\n- Exploit Intelligence\n- Red Hat Connectivity Link 1\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift Dev Spaces\n- Red Hat Satellite 6\n- Self-service automation portal 2\n\n## Remediation\n\nWill not fix\n\nWorkarounds / mitigations:\n\n- Upgrade to sigstore 4.1.1 or later.\n\nThe majority of products have sigstore-js as a transitive dependency from the npm v10.9.7 package.\n```\nsh-5.1$ npm ls sigstore\nnpm@10.9.7 /usr/lib/node_modules/npm\n+-- @npmcli/arborist@8.0.4\n| `-- @npmcli/metavuln-calculator@8.0.1\n|   `-- pacote@20.0.1\n|     `-- sigstore@3.1.0 deduped\n+-- libnpmpublish@10.0.2\n| `-- sigstore@3.1.0\n`-- pacote@19.0.2\n  `-- sigstore@3.1.0 deduped\n```\n\n## Package advisory (CVE-2026-48815)\n\nAffected packages:\n\n- `sigstore <= 4.1.0`\n\nPatched in:\n\n- `sigstore 4.1.1`\n\nSource: https://github.com/advisories/GHSA-52v5-jr5w-gjxr","depth":"sunlit","depthScore":32,"depthScoreParts":{"impact":32.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":201706,"id":"CVE-2026-48815","ts":1789399627946,"field":"cvss","old":"7.5","new":"5.9"},{"seq":201705,"id":"CVE-2026-48815","ts":1789399627946,"field":"severity","old":"high","new":"medium"},{"seq":200438,"id":"CVE-2026-48815","ts":1789397263516,"field":"cvss","old":"5.9","new":"7.5"},{"seq":200437,"id":"CVE-2026-48815","ts":1789397263516,"field":"severity","old":"medium","new":"high"},{"seq":198361,"id":"CVE-2026-48815","ts":1789391865761,"field":"cvss","old":"7.5","new":"5.9"},{"seq":198360,"id":"CVE-2026-48815","ts":1789391865761,"field":"severity","old":"high","new":"medium"},{"seq":196153,"id":"CVE-2026-48815","ts":1789383516454,"field":"cvss","old":"5.9","new":"7.5"},{"seq":196152,"id":"CVE-2026-48815","ts":1789383516454,"field":"severity","old":"medium","new":"high"},{"seq":195082,"id":"CVE-2026-48815","ts":1789380394929,"field":"cvss","old":"7.5","new":"5.9"},{"seq":195081,"id":"CVE-2026-48815","ts":1789380394929,"field":"severity","old":"high","new":"medium"},{"seq":193869,"id":"CVE-2026-48815","ts":1789378383078,"field":"cvss","old":"5.9","new":"7.5"},{"seq":193868,"id":"CVE-2026-48815","ts":1789378383078,"field":"severity","old":"medium","new":"high"},{"seq":192656,"id":"CVE-2026-48815","ts":1789376343865,"field":"cvss","old":"7.5","new":"5.9"},{"seq":192655,"id":"CVE-2026-48815","ts":1789376343865,"field":"severity","old":"high","new":"medium"},{"seq":191443,"id":"CVE-2026-48815","ts":1789373283892,"field":"cvss","old":"5.9","new":"7.5"},{"seq":191442,"id":"CVE-2026-48815","ts":1789373283892,"field":"severity","old":"medium","new":"high"},{"seq":190228,"id":"CVE-2026-48815","ts":1789369228629,"field":"cvss","old":"7.5","new":"5.9"},{"seq":190227,"id":"CVE-2026-48815","ts":1789369228629,"field":"severity","old":"high","new":"medium"},{"seq":189015,"id":"CVE-2026-48815","ts":1789368164167,"field":"cvss","old":"5.9","new":"7.5"},{"seq":189014,"id":"CVE-2026-48815","ts":1789368164167,"field":"severity","old":"medium","new":"high"},{"seq":187798,"id":"CVE-2026-48815","ts":1789365081227,"field":"cvss","old":"7.5","new":"5.9"},{"seq":187797,"id":"CVE-2026-48815","ts":1789365081227,"field":"severity","old":"high","new":"medium"},{"seq":186585,"id":"CVE-2026-48815","ts":1789363148883,"field":"cvss","old":"5.9","new":"7.5"},{"seq":186584,"id":"CVE-2026-48815","ts":1789363148883,"field":"severity","old":"medium","new":"high"},{"seq":185371,"id":"CVE-2026-48815","ts":1789361039463,"field":"cvss","old":"7.5","new":"5.9"},{"seq":185370,"id":"CVE-2026-48815","ts":1789361039463,"field":"severity","old":"high","new":"medium"},{"seq":184158,"id":"CVE-2026-48815","ts":1789358050304,"field":"cvss","old":"5.9","new":"7.5"},{"seq":184157,"id":"CVE-2026-48815","ts":1789358050304,"field":"severity","old":"medium","new":"high"},{"seq":182409,"id":"CVE-2026-48815","ts":1789354162672,"field":"cvss","old":"7.5","new":"5.9"},{"seq":182408,"id":"CVE-2026-48815","ts":1789354162672,"field":"severity","old":"high","new":"medium"},{"seq":181202,"id":"CVE-2026-48815","ts":1789353032451,"field":"cvss","old":"5.9","new":"7.5"},{"seq":181201,"id":"CVE-2026-48815","ts":1789353032451,"field":"severity","old":"medium","new":"high"},{"seq":179995,"id":"CVE-2026-48815","ts":1789350101285,"field":"cvss","old":"7.5","new":"5.9"},{"seq":179994,"id":"CVE-2026-48815","ts":1789350101285,"field":"severity","old":"high","new":"medium"},{"seq":178788,"id":"CVE-2026-48815","ts":1789347985538,"field":"cvss","old":"5.9","new":"7.5"},{"seq":178787,"id":"CVE-2026-48815","ts":1789347985538,"field":"severity","old":"medium","new":"high"},{"seq":177581,"id":"CVE-2026-48815","ts":1789346237709,"field":"cvss","old":"7.5","new":"5.9"},{"seq":177580,"id":"CVE-2026-48815","ts":1789346237709,"field":"severity","old":"high","new":"medium"},{"seq":176374,"id":"CVE-2026-48815","ts":1789342901219,"field":"cvss","old":"5.9","new":"7.5"},{"seq":176373,"id":"CVE-2026-48815","ts":1789342901219,"field":"severity","old":"medium","new":"high"},{"seq":175828,"id":"CVE-2026-48815","ts":1789338685549,"field":"cvss","old":"7.5","new":"5.9"},{"seq":175827,"id":"CVE-2026-48815","ts":1789338685549,"field":"severity","old":"high","new":"medium"},{"seq":175698,"id":"CVE-2026-48815","ts":1789338505126,"field":"cvss","old":"5.9","new":"7.5"},{"seq":175697,"id":"CVE-2026-48815","ts":1789338505126,"field":"severity","old":"medium","new":"high"},{"seq":174493,"id":"CVE-2026-48815","ts":1789334680865,"field":"cvss","old":"7.5","new":"5.9"},{"seq":174492,"id":"CVE-2026-48815","ts":1789334680865,"field":"severity","old":"high","new":"medium"},{"seq":173288,"id":"CVE-2026-48815","ts":1789333366552,"field":"cvss","old":"5.9","new":"7.5"},{"seq":173287,"id":"CVE-2026-48815","ts":1789333366552,"field":"severity","old":"medium","new":"high"},{"seq":172102,"id":"CVE-2026-48815","ts":1789330950212,"field":"cvss","old":"7.5","new":"5.9"},{"seq":172101,"id":"CVE-2026-48815","ts":1789330950212,"field":"severity","old":"high","new":"medium"}]}