CVE-2026-24122

What it actually does

The vulnerability lies in Cosign's certificate chain validation logic. It incorrectly assumes that root and intermediate certificates are valid for the entire duration of a leaf certificate's validity period. This allows a signature to be considered valid even if it was created using a certificate chain where an intermediate certificate had already expired at the time of signing, as long as the signing timestamp is within the leaf certificate's validity window. This bypasses a critical aspect of PKI trust and certificate lifecycle enforcement.

Why it matters to the business

This flaw undermines the integrity of the software supply chain. An attacker could use a compromised and expired signing certificate to sign malicious software artifacts, which would then be incorrectly trusted and accepted by automated systems. This could lead to the deployment of malicious code, resulting in unauthorized access, data breaches, or service disruption. The risk is primarily for organizations that operate private Public Key Infrastructures (PKIs) with Cosign, as the public Sigstore infrastructure is not affected.

How an attack unfolds

An attacker first needs to possess the private key of an intermediate certificate that has expired. They then use this expired key to issue a new leaf certificate with a validity period that extends past the intermediate's expiration date. The attacker signs a malicious artifact (e.g., a container image) with this new leaf certificate. When a vulnerable version of Cosign attempts to verify this artifact, it checks the certificate chain. It confirms the leaf certificate is valid at the time of signing but fails to properly check if the issuing intermediate certificate was also valid at that same time. Cosign incorrectly trusts the signature, allowing the malicious artifact to pass verification and potentially be deployed into a production environment.

How to fix it

To remediate this vulnerability, upgrade Cosign to version 3.0.5 or later. For users building from source, ensure the codebase includes commit `479147a4df05f31be48aeb2b3a9d32dfc35ba877` or a later version. This patch corrects the certificate chain validation logic to properly check the validity of all certificates in the chain at the time of signing.

How to confirm the fix worked

To identify vulnerable systems, audit all CI/CD pipelines, admission controllers, and other systems that use Cosign for signature verification. Check the version of the Cosign binary; versions 3.0.4 and below are vulnerable. To validate the fix, create a test case with a custom PKI where an intermediate certificate is expired. Use it to sign a new leaf certificate and then sign an artifact. Attempt to verify this artifact with the upgraded Cosign instance; the verification process should now correctly fail.

Typical attack path

1. An attacker gains control of a private key for an intermediate certificate in a private PKI.
2. The intermediate certificate's validity period expires.
3. The attacker crafts a new leaf certificate, signed by the expired intermediate, with a future validity date.
4. The attacker signs a malicious container image or binary using the new leaf certificate.
5. The signed malicious artifact is submitted to a CI/CD pipeline or registry that uses a vulnerable Cosign version for verification.
6. The vulnerable Cosign instance incorrectly validates the signature as trustworthy.
7. The malicious artifact is accepted and deployed, leading to a supply chain compromise.

How to detect it

Detecting past exploitation requires forensic analysis of verification logs. An analyst would need to examine the logs from Cosign verification points (e.g., CI/CD runners, Kubernetes admission controllers) for successfully verified artifacts. For each verification, the entire certificate chain used for the signature must be inspected. The key indicator of compromise is finding a verified signature where the signing timestamp (from Rekor or a trusted timestamp authority) is later than the 'not after' date of any intermediate certificate in the chain. This is a complex analysis that requires detailed logging of the certificates used in each verification.

What your security team should do

• Identify all instances of Cosign within your environment, paying special attention to CI/CD systems and artifact registries that rely on private PKIs.
• Prioritize and upgrade all identified vulnerable Cosign instances to version 3.0.5 or newer immediately.
• Review certificate lifecycle management policies for your private PKIs to ensure timely rotation and revocation of intermediate certificates.
• Consider implementing monitoring to detect and alert on the use of expired certificates within your signing infrastructure.