CVE-2026-39395 affects the sigstore cosign tool used for code signing and transparency of containers and binaries. In versions >= 3.0.0 and < 3.0.6, and versions < 2.6.3, the verify-blob-attestation command may incorrectly validate attestations with malformed payloads or mismatched predicate types. For old-format bundles and detached signatures, this was caused by a logic flaw in error handling during predicate type validation. For new-format bundles, predicate type validation was completely bypassed. This vulnerability allows erroneous verification results, potentially undermining trust in signed artifacts. The issue is resolved in cosign versions 3.0.6 and 2.6.3.

The vulnerability can cause cosign to incorrectly report that an attestation is verified when it contains malformed or mismatched predicate data. This could lead to a false sense of security in the integrity and authenticity of signed containers or binaries. However, there is no direct impact on confidentiality or availability, and no known exploits in the wild have been reported.

Upgrade cosign to version 3.0.6 or later, or 2.6.3 or later, where this vulnerability is fixed. Patch status is confirmed by the version information in the description. No other mitigation steps are indicated.