CVE Watch13 ago 2026

CVE-2026-48791

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the

CVSS

2.0

Bajo

EPSS

—

KEV

—

Exploit Today

0-100

Publicado: 13 ago 2026 · Última mod.: 13 ago 2026 · CWE-347

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated (Rekor entry) time) against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verification spec. The old sigstore-conformance test for this check was built incorrectly. This vulnerability impacts only users verifying bundles with `dev.sigstore:sigstore-java:2.0.0`. Older versions are not affected; it is fixed in `dev.sigstore:sigstore-java:2.1.0` A malicious actor may exploit this if they were able to access a users system and exfiltrate the temporary private key used during signing and then reuse an old fulcio certificate later without requiring direct access to the user's credentials. Users may protect themselves by re-verifying their artifacts using the newest sigstore-java or another current sigstore client. Transparency logs may also be audited for unauthorized signatures for a suspected reused identity.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-122638.8 ALT

—

——0Zohocorp ManageEngine Password Manager Pro versions before 13232 and PAM360 versions before 8551 are vulnerable to an authentication bypass vulnerability due to improper SAML validation.2h CVE-2026-687597.2 ALT

—

——0A holder of a valid integration credential may impersonate other users under specific conditions.18h CVE-2026-687577.5 ALT

—

——0A user with access to a valid SAML response may impersonate another user under specific conditions.17h CVE-2026-627575.3 MED

16.2%

——5Improper verification of cryptographic signature in Windows Schannel allows an unauthorized attacker to bypass a security feature over a network.22h CVE-2026-155568.1 ALT

11.5%

——3A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML response and auth as any principal with any roles on the protected application.21h CVE-2026-105799.8 CRÍ

22.8%

——7A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted operations, or other flaws.2d