Prior to 0.14.0, an attacker with push access to gittuf's Reference State Log (RSL) can roll back the current policy to any previous policy trusted… (CVE-2026-44544)

gittuf is a platform-agnostic Git security system that uses a Reference State Log (RSL) to determine which policy to load. Prior to version 0.14.0, if an attacker has push access to the RSL, they can insert an entry referencing an older policy that is still trusted by the current root keys. Since gittuf validates new policies by verifying signatures against the current root keys, this allows the attacker to roll back the policy to a previous trusted state. This rollback can undermine security guarantees by reverting to outdated policies. The vulnerability is addressed and fixed in gittuf version 0.14.0.

An attacker with push access to the Reference State Log can revert gittuf's policy to any previously trusted policy state, potentially bypassing security updates or restrictions introduced in newer policies. This rollback could weaken the security posture enforced by gittuf, allowing unauthorized or outdated configurations to be applied.

Upgrade gittuf to version 0.14.0 or later, where this rollback vulnerability has been fixed. No other mitigation is indicated by the vendor advisory.