CVE Feed

    Dashboard / CVE / CVE-2026-39395

    CVE-2026-39395

    Cosign provides code signing and transparency for containers and binaries. Prior to 3.0.6 and 2.6.3, cosign verify-blob-attestation may erroneously report a "Verified OK" result for attestations with malformed payloads or mismatched predicate types. For old-format bundles and detached signatures, this was due to a logic flaw in the error handling of the predicate type validation. For new-format bundles, the predicate type validation was bypassed completely. This vulnerability is fixed in 3.0.6 and 2.6.3.

    Published:Apr 7, 2026
    Last Modified:Apr 15, 2026
    EPS:Apr 7, 2026
    EPSS Score:0.00031
    CVSS Score:4.3

    Affected Products

    Vendor
    Sigstore
    Product
    Cosign

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-463 Padding Oracle Crypto Attack
    CAPEC-475 Signature Spoofing by Improper Validation

    Related CVEs

    CVE-2026-24122 (CVSS 3.7) — Cosign provides code signing and transparency for containers and binaries. In versions 3.0.4 and below, an iss…
    CVE-2026-22703 (CVSS 5.5) — Cosign provides code signing and transparency for containers and binaries. Prior to versions 2.6.2 and 3.0.4, …
    CVE-2024-29902 (CVSS 4.2) — Cosign provides code signing and transparency for containers and binaries. Prior to version 2.2.4, a remote im…
    CVE-2024-29903 (CVSS 4.2) — Cosign provides code signing and transparency for containers and binaries. Prior to version 2.2.4, maliciously…
    CVE-2023-46737 (CVSS 3.1) — Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attac…
    CVE-2022-36056 (CVSS 5.5) — Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure. In…
    CVE-2022-35929 (CVSS 7.1) — cosign is a container signing and verification utility. In versions prior to 1.10.1 cosign can report a false …
    CVE-2022-23649 (CVSS 3.3) — Cosign provides container signing, verification, and storage in an OCI registry for the sigstore project. Prio…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High