CVE-2026-39395
Medium · 4.3CVSS
4.3
EPSS
0.3%
Published
Apr 7, 2026
CISA due date
—
The record
Cosign provides code signing and transparency for containers and binaries. Prior to 3.0.6 and 2.6.3, cosign verify-blob-attestation may erroneously report a "Verified OK" result for attestations with malformed payloads or mismatched predicate types. For old-format bundles and detached signatures, this was due to a logic flaw in the error handling of the predicate type validation. For new-format bundles, the predicate type validation was bypassed completely. This vulnerability is fixed in 3.0.6 and 2.6.3.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | cosign | 0 | 3.0.6-160000.1.1 |
| openSUSE:Tumbleweed | cosign | 0 | 3.0.6-1.1 |
Related vulnerabilities
- CVE-2026-24122 Cosign provides code signing and transparency for containers and binaries. Also affects cosign
- CVE-2026-23991 go-tuf is a Go implementation of The Update Framework (TUF). Also affects cosign
- CVE-2026-23992 go-tuf is a Go implementation of The Update Framework (TUF). Also affects cosign
- CVE-2026-22772 Fulcio is a certificate authority for issuing code signing certificates for an OpenID… Also affects cosign
- CVE-2026-22703 Cosign provides code signing and transparency for containers and binaries. Also affects cosign
- CVE-2026-100352 kin-openapi is a Go project for handling OpenAPI files. CWE-754
- CVE-2026-98161 In the Linux kernel, the following vulnerability has been resolved: nvdimm: pmem: keep… CWE-754
- CVE-2026-77411 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. CWE-754