CVE-2026-39395
mediumpriority · track · 21EPSS 0.003 · 21 %ileEUUSEPSS · scored 2026-10-24
Cosign provides code signing and transparency for containers and binaries. Prior to 3.0.6 and 2.6.3, cosign verify-blob-attestation may erroneously report a "Verified OK" result for attestations with malformed payloads or mismatched predicate types. For old-format bundles and detached signatures, this was due to a logic flaw in the error handling of the predicate type validation. For new-format bundles, the predicate type validation was bypassed completely. This vulnerability is fixed in 3.0.6 and 2.6.3.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (11)
Products and version ranges known to be affected.
advisories (3)
Vendor and ecosystem advisories describing this.
- GHSA-w6c6-c85g-mmv6Cosign's verify-blob-attestation reports false positive when payload parsing fails2026-04-08ghsa · osvUS
## Description `cosign verify-blob-attestation` may erroneously report a "Verified OK" result for attestations with malformed payloads or mismatched predicate types. For old-format bundles and detached signatures, this was due to a logic flaw in the error handling of the predicate type validation. For new-format bundles, the predicate type validation was bypassed completely. ## Impact When `cosign verify-blob-attestation` is used without `--check-claims` set to `true`, an attestation that has a valid signature but a malformed or unparsable payload would be incorrectly validated. Additionally, systems relying on `--type <predicate type>` to reject attestations with mismatched types would be lead to trust the unexpected attestation type. ## Patches v3.0.6, v2.6.3 ## Workarounds Always set `--check-claims=true` for attestation verification.
- BIT-cosign-2026-39395Cosign's verify-blob-attestation reports false positive when payload parsing fails2026-04-09vendor · osvUS
Cosign provides code signing and transparency for containers and binaries. Prior to 3.0.6 and 2.6.3, cosign verify-blob-attestation may erroneously report a "Verified OK" result for attestations with malformed payloads or mismatched predicate types. For old-format bundles and detached signatures, this was due to a logic flaw in the error handling of the predicate type validation. For new-format bundles, the predicate type validation was bypassed completely. This vulnerability is fixed in 3.0.6 and 2.6.3.
- GO-2026-5694Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign2026-06-25vendor · osvUS
Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign
also known as (6)
Other names and identifiers for this entity.
- CNNVD-202604-1176cnnvd
- EUVD-2026-19919enisa_euvd
- GHSA-w6c6-c85g-mmv6enisa_euvd
- BIT-cosign-2026-39395osv
- GHSA-w6c6-c85g-mmv6osv
- GO-2026-5694osv
sources
Which sources assert this record, and when.
references (4)
External citations — patches, advisories, analysis.
- https://github.com/sigstore/cosign/releasesPatchcnnvd
- https://github.com/sigstore/cosign/security/advisories/GHSA-w6c6-c85g-mmv6cnnvd
- https://github.com/sigstore/cosign/security/advisories/GHSA-w6c6-c85g-mmv6enisa_euvd
- https://github.com/sigstore/cosign/security/advisories/GHSA-w6c6-c85g-mmv6MitigationVendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan