CVE-2026-39984

The record

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Versions 2.0.5 and below contain an authorization bypass vulnerability in the VerifyTimestampResponse function. VerifyTimestampResponse correctly verifies the certificate chain signature, but the TSA-specific constraint checks in VerifyLeafCert uses the first non-CA certificate from the PKCS#7 certificate bag instead of the leaf certificate from the verified chain. An attacker can exploit this by prepending a forged certificate to the certificate bag while the message is signed with an authorized key, causing the library to validate the signature against one certificate but perform authorization checks against another. This vulnerability only affects users of the timestamp-authority/v2/pkg/verification package and does not affect the timestamp-authority service itself or sigstore-go. The issue has been fixed in version 2.0.6.

Affected packages

Related vulnerabilities

• CVE-2026-41567 Moby is an open source container framework. Also affects docker
• CVE-2026-39821 The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that… Also affects docker
• CVE-2026-33814 When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing… Also affects docker
• CVE-2024-23652 BuildKit is a toolkit for converting source code to build artifacts in an efficient… Also affects docker
• CVE-2024-23651 BuildKit is a toolkit for converting source code to build artifacts in an efficient… Also affects docker
• CVE-2024-23653 BuildKit is a toolkit for converting source code to build artifacts in an efficient… Also affects docker
• CVE-2020-8695 Observable discrepancy in the RAPL interface for some Intel(R) Processors may allow a… Also affects docker
• CVE-2026-25681 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected… Also affects hauler