CVE-2026-49834 is a vulnerability in the sigstore-go library, which is used for Sigstore signing and verification in Go. The flaw permits an attacker who compromises a single transparency log or Certificate Transparency log to bypass the multi-log threshold verification requirements. This bypass defeats the intended security policy designed to ensure signature integrity. The vulnerability affects Red Hat Hardened Images RPMs, specifically the trivy package versions prior to 0.72.0-0.1.3.hum1. Red Hat has issued a security advisory and released updated RPMs to fix this issue. The CVE is associated with CWE-347 (Improper Verification of Cryptographic Signature), CWE-345, and CWE-835. Red Hat’s CVSS v3.1 score is 5.9 (moderate), but the vendor rates the severity as high due to the impact on signature verification integrity.

An attacker who compromises a single transparency log can bypass the multi-log threshold verification process, potentially compromising the integrity of cryptographic signature verification. This could allow unauthorized code or data modifications to go undetected, impacting the trustworthiness of signed artifacts. The vulnerability affects the integrity of the verification process but does not impact confidentiality or availability directly. No known exploits in the wild have been reported at this time.

An official patch is available from Red Hat. Users should update the trivy package to version 0.72.0-0.1.3.hum1 or later as provided in the Red Hat Hardened Images RPMs update. Red Hat manages the release and distribution of this fix. No additional mitigations are specified beyond applying the update.