Security update for cosign
Description
This security update for cosign version 3.0.5 addresses multiple vulnerabilities including improper certificate validation, path traversal allowing arbitrary file writes, SSRF via URL validation bypass, denial of service from invalid metadata, unauthorized metadata modification, sensitive information leaks in logs, and memory consumption issues. These fixes resolve issues that could lead to undefined behavior, arbitrary internal service access, denial of service, information disclosure, and acceptance of invalid verification entries. The update is provided by the SUSE Product Security Team and affects specific cosign package versions.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The cosign 3.0.5 update fixes several security vulnerabilities: CVE-2026-24122 addresses improper validation of certificates that outlive expired CA certificates; CVE-2026-26958 fixes a failure in MultiScalarMult initialization causing undefined behavior; CVE-2026-24137 patches a path traversal vulnerability in the legacy TUF client allowing arbitrary file writes; CVE-2026-22772 corrects a MetaIssuer URL validation bypass that could trigger SSRF to internal services; CVE-2026-23991 and CVE-2026-23992 fix denial of service and unauthorized modification issues in TUF metadata handling; CVE-2025-11065 resolves sensitive information leaks in logs; CVE-2026-22703 addresses acceptance of any valid Rekor entry under certain conditions during verification; and CVE-2025-58181 fixes unbounded memory consumption due to invalid SSH mechanism counts. These collectively improve the security posture of cosign by mitigating risks of unauthorized access, data leakage, and service disruption.
Potential Impact
The vulnerabilities fixed in this update could allow attackers to bypass certificate validation, write arbitrary files via path traversal, perform server-side request forgery (SSRF) to internal services, cause denial of service through malformed metadata, leak sensitive information in logs, and cause unbounded memory consumption. Additionally, verification processes could be bypassed under certain conditions, potentially undermining trust in signed artifacts. These impacts affect the integrity, confidentiality, and availability of systems using vulnerable cosign versions.
Mitigation Recommendations
A security update to cosign version 3.0.5 is available and addresses all listed vulnerabilities. Users should upgrade to this version promptly to mitigate these risks. No additional mitigations are specified or required beyond applying this official fix.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- CLEANSTART-2026-DA82476
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Alpine"]
- State
- PUBLISHED
Threat ID: 6a98453dacd9273b496aad3a
Added to database: 09/02/2026, 15:48:13 UTC
Last enriched: 09/17/2026, 03:29:06 UTC
Last updated: 10/18/2026, 06:48:11 UTC
Views: 61
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.