sigstore has 16 CVEs on record between 2022 and 2026. Disclosure cadence is accelerating: 6 in the last 90 days against 2 in the 90 before. The busiest recent month was January 2026 with 3. The median CVSS is 5.5 (medium), with 1 rated critical. None have a confirmed exploitation report. Most affected products: github.com/sigstore/gitsign (2), sigstore (2), @sigstore/core (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.5
- Publish → KEV
- —
- Last 90 days
- 6 prev 2
Products
- github.com/sigstore/gitsign 2
- sigstore 2
- @sigstore/core 1
- @sigstore/oci 1
- @sigstore/verify 1
- dev.sigstore:sigstore-java 1
Worst active — by depth score
CVE-2026-59891Critical· 9.6Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry65CVE-2025-66564High· 7.5Sigstore Timestamp Authority allocates excessive memory during request parsing41CVE-2023-30551High· 7.5Rekor's compressed archives can result in OOM conditions41CVE-2022-35930High· 7.1PolicyController before 0.2.1 may bypass attestation verification39CVE-2026-48816Medium· 6.5sigstore-js has Insufficient Verification of Data Authenticity36
sigstore vulnerabilities
CVEs affecting sigstore, newest first. Open any entry for full detail, references, and exploit status.
16 CVEsRSS
CVE-2026-48791Low· 2.0sigstore-java is a sigstore java client for interacting with sigstore infrastructure
sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated (Rekor entry) time) against the Fulcio certificate. Version 2.1.0 re-added this verifi…
CVE-2026-54787Low· 3.1sigstore-go is a Go library for Sigstore signing and verification
sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without…
CVE-2026-59891Critical· 9.6PoCCredential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry
Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry
CVE-2026-48816Medium· 6.5sigstore-js has Insufficient Verification of Data Authenticity
sigstore-js has Insufficient Verification of Data Authenticity
CVE-2026-49835Medium· 5.9Sigstore Timestamp Authority has OOM due to unbounded metric label cardinality
Sigstore Timestamp Authority has OOM due to unbounded metric label cardinality
CVE-2026-48758Medium· 5.4@sigstore/core has DSSE payloadType type-binding failure
@sigstore/core has DSSE payloadType type-binding failure
CVE-2026-44309Medium· 5.3gitsign verify accepts signatures over go-git-normalized bytes, enabling trust confusion on malformed commits
gitsign verify accepts signatures over go-git-normalized bytes, enabling trust confusion on malformed commits
CVE-2026-44310Medium· 5.4gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers
gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers
CVE-2026-24408None· 0.0sigstore CSRF possibility in OIDC authentication during signing
sigstore CSRF possibility in OIDC authentication during signing
CVE-2026-22772Medium· 5.8Fulcio is vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass
Fulcio is vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass
CVE-2026-22703Medium· 5.5Cosign verification accepts any valid Rekor entry under certain conditions
Cosign verification accepts any valid Rekor entry under certain conditions
CVE-2025-66564High· 7.5Sigstore Timestamp Authority allocates excessive memory during request parsing
Sigstore Timestamp Authority allocates excessive memory during request parsing
CVE-2024-55655Lowsigstore has insufficient validation of integration timestamp during verification
sigstore has insufficient validation of integration timestamp during verification
CVE-2024-29902Medium· 4.2Cosign malicious attachments can cause system-wide denial of service
Cosign malicious attachments can cause system-wide denial of service
CVE-2023-30551High· 7.5Rekor's compressed archives can result in OOM conditions
Rekor's compressed archives can result in OOM conditions
CVE-2022-35930High· 7.1PolicyController before 0.2.1 may bypass attestation verification
PolicyController before 0.2.1 may bypass attestation verification