CVE-2026-123806 is a platform-dependent path pattern matching vulnerability in the python-tuf component of Sigstore. The issue arises because the delegation path matching uses Python's fnmatch.fnmatch, which applies case normalization differently on Windows (case-insensitive) versus POSIX systems (case-sensitive). This discrepancy can cause a TUF specification violation on Windows clients, allowing an attacker controlling a delegation role with a case-colliding path pattern to influence target authorization. The vulnerability affects Sigstore versions >=2.0.1 and <4.3.0 and is fixed in version 4.3.0.