GHSA-9vcr-p3rj-q5q6: sigstore-go has a multi-log threshold bypass via single compromised log
sigstore-go versions prior to 1.2.0 contain a vulnerability where the multi-log threshold verification can be bypassed by a single compromised transparency log. This occurs because the threshold counting incorrectly counts verified witnesses per entry or validation path rather than per log authority, allowing a single compromised log to satisfy multi-log threshold requirements and defeat the intended defense-in-depth. Cosign is not affected as it uses a threshold of 1. The issue is fixed in version 1.1.5. No workaround exists other than relying on trusted logs.
AI Analysis
Technical Summary
The vulnerability in sigstore-go involves an incorrect implementation of multi-log threshold verification when configured with WithTransparencyLog(N>1) or WithSignedCertificateTimestamps(N>1). Instead of counting verified witnesses per log authority, the counting is done per entry or validation path, enabling a single compromised transparency log to forge multiple entries or verify multiple times, thereby bypassing the multi-log threshold policy. This undermines the defense-in-depth strategy against log compromise. The vulnerability does not affect Cosign, which uses a threshold of 1. The issue is addressed by upgrading to sigstore-go version 1.1.5.
Potential Impact
An attacker controlling a single transparency log can bypass multi-log threshold verification policies, potentially allowing forged entries to be accepted as valid. This compromises the integrity of the verification process and defeats the defense-in-depth mechanism designed to require multiple independent logs for validation. There is no impact on confidentiality or availability, but the integrity of signature verification is affected.
Mitigation Recommendations
Upgrade sigstore-go to version 1.1.5 or later to apply the official fix. There is no effective workaround other than relying on trusted transparency logs. Users should not rely on multi-log threshold configurations with versions prior to 1.2.0.
GHSA-9vcr-p3rj-q5q6: sigstore-go has a multi-log threshold bypass via single compromised log
Description
sigstore-go versions prior to 1.2.0 contain a vulnerability where the multi-log threshold verification can be bypassed by a single compromised transparency log. This occurs because the threshold counting incorrectly counts verified witnesses per entry or validation path rather than per log authority, allowing a single compromised log to satisfy multi-log threshold requirements and defeat the intended defense-in-depth. Cosign is not affected as it uses a threshold of 1. The issue is fixed in version 1.1.5. No workaround exists other than relying on trusted logs.
CVSS v3.1
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in sigstore-go involves an incorrect implementation of multi-log threshold verification when configured with WithTransparencyLog(N>1) or WithSignedCertificateTimestamps(N>1). Instead of counting verified witnesses per log authority, the counting is done per entry or validation path, enabling a single compromised transparency log to forge multiple entries or verify multiple times, thereby bypassing the multi-log threshold policy. This undermines the defense-in-depth strategy against log compromise. The vulnerability does not affect Cosign, which uses a threshold of 1. The issue is addressed by upgrading to sigstore-go version 1.1.5.
Potential Impact
An attacker controlling a single transparency log can bypass multi-log threshold verification policies, potentially allowing forged entries to be accepted as valid. This compromises the integrity of the verification process and defeats the defense-in-depth mechanism designed to require multiple independent logs for validation. There is no impact on confidentiality or availability, but the integrity of signature verification is affected.
Mitigation Recommendations
Upgrade sigstore-go to version 1.1.5 or later to apply the official fix. There is no effective workaround other than relying on trusted transparency logs. Users should not rely on multi-log threshold configurations with versions prior to 1.2.0.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-9vcr-p3rj-q5q6
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-49834"]
- Ecosystems
- ["Go"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a50ba3c68715ace4357db1d
Added to database: 07/10/2026, 09:24:12 UTC
Last enriched: 07/10/2026, 09:33:19 UTC
Last updated: 07/10/2026, 13:51:16 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.