sigstore CSRF Möglichkeit in OIDC Authentifizierung während der Signierung

The impact of CVE-2026-24408 is considered low, but still concerning. An attacker exploiting this vulnerability could craft a malicious request that, when triggered by a user, would cause sigstore-python to sign data using the user's credentials, but with the attacker's intended identity. This could lead to unauthorized code signing or other actions performed under the guise of the legitimate user. While the vulnerability requires a man-in-the-middle attack scenario, successful exploitation could compromise the integrity of signed artifacts and potentially undermine trust in the signing process. The attack relies on social engineering to trick the user into interacting with the malicious request.

Developers and organizations using sigstore-python for code signing and verification are at risk. Specifically, those relying on OAuth authentication for sigstore-python and using versions prior to 4.2.0 are vulnerable. Shared hosting environments where multiple users share the same sigstore-python installation could also be affected.

• python / sigstore: Inspect OAuth authentication flows for unexpected requests or parameters.

# Example: Check for unusual state parameters in OAuth requests
import re
pattern = r'state=[a-zA-Z0-9_-]+'
# Analyze network traffic or application logs for this pattern

• python / sigstore: Monitor for unusual code signing activity or unexpected signatures.

# Example: Check for signatures from unknown or suspicious identities
import cryptography
# Analyze code signing certificates and signatures

1. 2026-01-26Disclosure

   disclosure

1. Reserviert2026-01-22
2. Veröffentlicht2026-01-26
3. Geändert2026-02-03
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-24408 is to upgrade to sigstore-python version 4.2.0 or later, which includes the fix for the CSRF vulnerability. If upgrading is not immediately feasible, consider implementing additional security measures. User awareness training is crucial to educate users about the risks of phishing and malicious websites. Implementing a Web Application Firewall (WAF) with rules to filter suspicious OAuth requests, particularly those lacking proper state validation, can provide an additional layer of protection. Regularly review and audit OAuth configurations to ensure best practices are followed.