GO-2026-4529
NoneCVSS
—
EPSS
—
Published
Feb 23, 2026
CISA due date
—
The record
Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/sigstore/cosign | 0 | No fix |
| Go | github.com/sigstore/cosign | 0 | 3.0.5 |
| Go | github.com/sigstore/cosign/v2 | 0 | No fix |
| Go | github.com/sigstore/cosign/v3 | 0 | 3.0.5 |