The cosign package version 3.1.2-r1 includes fixes for nine vulnerabilities, including CVE-2026-54787. This CVE relates to security weaknesses involving improper verification of cryptographic signatures (CWE-347) and potentially other issues (CWE-835). The affected products include Red Hat Hardened Images and associated RPMs for architectures such as aarch64 and x86_64. Red Hat Product Security issued advisory RHSA-2026:47891 detailing the update. The patch mitigates the identified vulnerabilities by correcting the verification process and other related security flaws. No active exploitation has been reported. The update is available and should be applied to affected systems.

The vulnerabilities fixed in cosign 3.1.2-r1 could allow an attacker to bypass cryptographic signature verification, potentially compromising the integrity of signed artifacts. However, the overall severity is assessed as low, indicating limited impact or difficulty of exploitation. No known exploits in the wild have been reported. The update prevents attackers from exploiting these weaknesses to undermine trust in signed content.

A patch is available in cosign version 3.1.2-r1. Users of affected Red Hat Hardened Images and related products should update to this version to remediate the vulnerabilities. The vendor advisory RHSA-2026:47891 provides official guidance on applying the update. No additional mitigations are specified or required beyond applying the official patch.