CVE-2026-49834
sigstore-go: Multi-log threshold bypass via single compromised log
Reported by github_m · Published July 17, 2026
github.com/sigstore/sigstore-go is fixed in 1.2.0 (Go Modules)
sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.0, a verifier configured with WithTransparencyLog(N>1) or WithSignedCertificateTimestamps(N>1) counts verified witnesses per entry or per validation path rather than per log authority, allowing a single compromised transparency log or CT log to satisfy multi-log threshold requirements and defeat the multi-log policy. This issue is fixed in version 1.2.0.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| github.com/sigstore/sigstore-go | Go Modules | 1.2.0 |
| kyverno-notation-aws-fips | Chainguard | 1.1-r60 |
| kyverno-1.16 | Chainguard | 1.16.4-r15 |
| gitsign | Wolfi | 0.16.1-r5 |
| crossplane-1.20 | Chainguard | 1.20.10-r6 |
| tflint | Chainguard | 0.63.1-r6 |
| kubescape-server | Chainguard | 4.0.10-r7 |
| spire-server-fips | Chainguard | 1.15.2-r0 |
| crossplane-2.0 | Chainguard | 2.0.8-r13 |
| cloudbeat-fips-9.4 | Chainguard | 9.4.3-r2 |
| crossplane-fips-2.3 | Chainguard | 2.3.3-r7 |
| crossplane-2.2 | Chainguard | 2.2.3-r7 |
47 more packages have a fixed version. See every fix in Lookup.
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| sigstore | sigstore-go | < 1.2.0 |
| chainguard | kyverno-notation-aws-fips | 0 |
| chainguard | kyverno-1.16 | 0 |
| wolfi | gitsign | 0 |
| chainguard | crossplane-1.20 | 0 |
| chainguard | tflint | 0 |
| chainguard | kubescape-server | 0 |
| chainguard | spire-server-fips | 0 |
| chainguard | crossplane-2.0 | 0 |
| chainguard | cloudbeat-fips-9.4 | 0 |
| github.com | sigstore/sigstore-go | 0 |
| chainguard | crossplane-fips-2.3 | 0 |
| chainguard | crossplane-2.2 | 0 |
| chainguard | cloudbeat-9.4 | 0 |
| chainguard | kubescape-server-fips | 0 |
| chainguard | image-factory | 0 |
| chainguard | ratify | 0, 0 |
| chainguard | trivy-fips | 0 |
| wolfi | trivy | 0 |
| chainguard | tbot | 0 |
…and 60 more
Timeline
- Jul 9, 2026 CVE Published
- Jul 18, 2026 Security Advisory
- Aug 7, 2026 EPSS Score (8 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-49834
vulnetix vdb fixes CVE-2026-49834Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-49834/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://github.com/sigstore/sigstore-go/security/advisories/GHSA-9vcr-p3rj-q5q6 x_refsource_CONFIRM
- https://github.com/sigstore/sigstore-go/pull/633 x_refsource_MISC
- https://github.com/sigstore/sigstore-go/commit/dbb07e62623edd5b175fb9dd5a41dcb85a159207 x_refsource_MISC
- https://github.com/sigstore/sigstore-go/releases/tag/v1.2.0 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-49834 advisory
- https://github.com/advisories/GHSA-9vcr-p3rj-q5q6 advisory