CVE-2026-48791: CWE-347: Improper Verification of Cryptographic Signature in sigstore sigstore-java
sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated (Rekor entry) time) against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verification spec. The old sigstore-conformance test for this check was built incorrectly. This vulnerability impacts only users verifying bundles with `dev.sigstore:sigstore-java:2.0.0`. Older versions are not affected; it is fixed in `dev.sigstore:sigstore-java:2.1.0` A malicious actor may exploit this if they were able to access a users system and exfiltrate the temporary private key used during signing and then reuse an old fulcio certificate later without requiring direct access to the user's credentials. Users may protect themselves by re-verifying their artifacts using the newest sigstore-java or another current sigstore client. Transparency logs may also be audited for unauthorized signatures for a suspected reused identity.
AI Analysis
Technical Summary
The sigstore-java client version 2.0.0 removed the verification step that checks the integrated time of a Rekor log entry against the Fulcio certificate, violating the Sigstore verification specification. This regression was corrected in version 2.1.0 with improved verification. Exploitation requires an attacker to have exfiltrated the temporary private key used during signing, enabling reuse of an old Fulcio certificate to sign bundles without direct credential access. Older versions prior to 2.0.0 are not affected. The vulnerability is identified as CVE-2026-48791 and is classified under CWE-347 (Improper Verification of Cryptographic Signature).
Potential Impact
The vulnerability has a low severity impact (CVSS 2.0) and does not compromise confidentiality or availability. It allows limited integrity impact by enabling an attacker who has obtained the temporary signing private key to reuse an old Fulcio certificate for signing, potentially bypassing expected verification steps. There is no known exploitation in the wild. The risk is limited to users running version 2.0.0 of sigstore-java who verify bundles using this client.
Mitigation Recommendations
A patch is available in dev.sigstore:sigstore-java version 2.1.0 which restores and enhances the integrated time verification. Users should upgrade to version 2.1.0 or later to remediate this vulnerability. Additionally, users can protect themselves by re-verifying artifacts with the latest sigstore clients and auditing transparency logs for unauthorized signatures indicating potential reuse of identities. No other immediate actions are required.
CVE-2026-48791: CWE-347: Improper Verification of Cryptographic Signature in sigstore sigstore-java
Description
sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated (Rekor entry) time) against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verification spec. The old sigstore-conformance test for this check was built incorrectly. This vulnerability impacts only users verifying bundles with `dev.sigstore:sigstore-java:2.0.0`. Older versions are not affected; it is fixed in `dev.sigstore:sigstore-java:2.1.0` A malicious actor may exploit this if they were able to access a users system and exfiltrate the temporary private key used during signing and then reuse an old fulcio certificate later without requiring direct access to the user's credentials. Users may protect themselves by re-verifying their artifacts using the newest sigstore-java or another current sigstore client. Transparency logs may also be audited for unauthorized signatures for a suspected reused identity.
CVSS v3.1
Score 2.0low
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The sigstore-java client version 2.0.0 removed the verification step that checks the integrated time of a Rekor log entry against the Fulcio certificate, violating the Sigstore verification specification. This regression was corrected in version 2.1.0 with improved verification. Exploitation requires an attacker to have exfiltrated the temporary private key used during signing, enabling reuse of an old Fulcio certificate to sign bundles without direct credential access. Older versions prior to 2.0.0 are not affected. The vulnerability is identified as CVE-2026-48791 and is classified under CWE-347 (Improper Verification of Cryptographic Signature).
Potential Impact
The vulnerability has a low severity impact (CVSS 2.0) and does not compromise confidentiality or availability. It allows limited integrity impact by enabling an attacker who has obtained the temporary signing private key to reuse an old Fulcio certificate for signing, potentially bypassing expected verification steps. There is no known exploitation in the wild. The risk is limited to users running version 2.0.0 of sigstore-java who verify bundles using this client.
Mitigation Recommendations
A patch is available in dev.sigstore:sigstore-java version 2.1.0 which restores and enhances the integrated time verification. Users should upgrade to version 2.1.0 or later to remediate this vulnerability. Additionally, users can protect themselves by re-verifying artifacts with the latest sigstore clients and auditing transparency logs for unauthorized signatures indicating potential reuse of identities. No other immediate actions are required.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-qqw8-7c2r-jxch
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-48791"]
- Ecosystems
- ["Maven"]
- Database Specific Severity
- LOW
- Cvss Version
- 3.1
Threat ID: 6a4452e927e9c797198e1a93
Added to database: 06/30/2026, 23:36:09 UTC
Last enriched: 08/13/2026, 12:57:41 UTC
Last updated: 09/14/2026, 10:10:36 UTC
Views: 137
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.