Threats affecting pkg:golang/github.com/gittuf/gittuf

CVE-2026-128037 is an authorization vulnerability in gittuf versions 0.10.0 through 0.15.0. The issue arises when a minimum threshold global rule and a policy rule protect the same namespace, causing the global rule's check over all trusted users to override the policy rule's authorized users. This allows users listed in the policy file but not authorized by the policy rule, or fewer users than the threshold, to make changes that pass verification.

CVE-2026-128036 is an authorization vulnerability in gittuf versions 0.4.0 through 0.16.0. The flaw occurs during policy update verification where only the root of trust signatures are checked, ignoring signatures on other policy metadata such as rule files. This allows a trusted user who bypasses policy application controls to write invalid policy references directly, potentially weakening or strengthening rules for subsequent changes. The issue is fixed in version 0.17.0.

CVE-2026-128035 is an authorization vulnerability in gittuf versions 0.10.0 through 0.17.0. The verification workflow fails to apply policy updates propagated from an upstream controller repository after the initial verification entry. As a result, changes to global rules such as threshold requirements and force-push blocks made during verification are ignored, allowing changes that should be blocked to pass verification.

CVE-2026-128034 is an authorization vulnerability in gittuf versions before 0.18.0. The issue arises because file protection verification uses escaped pathnames instead of raw paths, causing files with special characters to be incorrectly treated as unprotected. This allows unauthorized users with limited privileges to modify protected files containing special characters without detection.