{"id":"CVE-2026-54787","title":"sigstore-go is a Go library for Sigstore signing and verification","summary":"sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without…","severity":"low","cvss":3.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","cwe":["CWE-324"],"vendor":"sigstore","product":"github.com/sigstore/sigstore-go","affected":["github.com/sigstore/sigstore-go <= 1.2.0"],"patched":["github.com/sigstore/sigstore-go 1.2.1"],"published":"2026-07-31","updated":"2026-09-10","sourceUpdated":"2026-09-10T20:30:11.423","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54787","references":[{"url":"https://github.com/sigstore/sigstore-go/commit/4594ab4c779d08be1f4419803a8249188f35ed5f","label":"security-advisories@github.com"},{"url":"https://github.com/sigstore/sigstore-go/pull/642","label":"security-advisories@github.com"},{"url":"https://github.com/sigstore/sigstore-go/releases/tag/v1.2.1","label":"security-advisories@github.com"},{"url":"https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm","label":"security-advisories@github.com"},{"url":"https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/advisories/GHSA-wqqc-jjcq-vfxm"}],"tags":["nvd","ghsa","go"],"epss":0.0009,"epssPercentile":0.00524,"aliases":["GHSA-wqqc-jjcq-vfxm"],"ecosystem":"go","ingestedAt":"2026-07-31T22:04:41.468Z","slug":"CVE-2026-54787","body":"## Overview\n\nsigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired key material to sign accepted bundles. This issue is fixed in version 1.2.1.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-54787)\n\nAffected packages:\n\n- `github.com/sigstore/sigstore-go <= 1.2.0`\n\nPatched in:\n\n- `github.com/sigstore/sigstore-go 1.2.1`\n\nSource: https://github.com/advisories/GHSA-wqqc-jjcq-vfxm","depth":"sunlit","depthScore":17,"depthScoreParts":{"impact":17.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}