Cosign betrachtete Signaturen als gültig mit abgelaufenen Zwischenzertifikaten, wenn die Überprüfung des Transparenzprotokolls übersprungen wurde in github.com/sigstore/cosign

The core impact of CVE-2026-24122 lies in the potential for unauthorized software installation. An attacker could sign a malicious artifact with a certificate chain that includes an expired intermediate certificate. If transparency log verification is disabled or bypassed, Cosign will incorrectly validate the signature as legitimate, allowing the attacker to distribute and install the malicious artifact. This could lead to a compromise of systems relying on Cosign for verification, potentially enabling attackers to gain control over container deployments or other critical infrastructure. The blast radius depends on the scope of Cosign's usage within an organization; widespread adoption increases the potential impact.

Organizations heavily reliant on Cosign for container image signing and verification are at risk. This includes DevOps teams, CI/CD pipelines, and any environment where Cosign is used to ensure the integrity of software artifacts. Specifically, those with custom Cosign configurations or those who have disabled transparency log verification are at higher risk.

• go / binary: Examine Cosign binaries for signs of tampering or modification. Use go build to rebuild from source and verify checksums. • generic web: Monitor Cosign API endpoints for unusual signature validation requests or errors. Check access logs for patterns indicative of attempted signature manipulation. • generic web: Inspect Cosign configuration files for disabled transparency log verification. Look for unusual certificate paths or settings. • generic web: Review system logs for Cosign-related errors or warnings, particularly those related to certificate validation.

1. 2026-02-23Disclosure

   disclosure

1. Reserviert2026-01-21
2. Veröffentlicht2026-02-23
3. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-24122 is to upgrade Cosign to version 3.0.5 or later, which includes the fix for this vulnerability. If upgrading is not immediately feasible, ensure that transparency log verification is enabled and properly configured within your Cosign workflows. Disabling transparency log verification should be avoided unless absolutely necessary and with a thorough understanding of the security implications. Consider implementing stricter certificate chain validation policies within your signing and verification processes to further reduce the risk. After upgrade, confirm by verifying signatures with known good artifacts and examining Cosign logs for any validation errors.