GHSA-fcv2-xgw5-pqxf: github.com/sigstore/sigstore fixed in 1.10.4

GHSA-fcv2-xgw5-pqxf PUBLISHED CVSS 5.800000190734863 MEDIUM

Duplicate

Record from GitHub Advisory Database · Published January 22, 2026

github.com/sigstore/sigstore is fixed in 1.10.4 (Go Modules)

Duplicate

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
github.com/sigstore/sigstore	Go Modules	1.10.4
vexctl	Wolfi	0.4.1-r9
buildkitd	Chainguard	0.27.1-r2
timestamp-authority	Wolfi	2.0.4-r1
spire-server-fips	Chainguard	1.14.1-r3
tekton-pipelines-1.0	Chainguard	1.0.0-r13
cloudbeat-fips-9.1	Chainguard	9.1.10-r29
undock	Wolfi	0.11.0-r3
tkn-fips	Chainguard	0.43.0-r4
tekton-pipelines-fips-1.3	Chainguard	1.3.2-r5
prometheus-podman-exporter-fips	Chainguard	1.20.0-r2
spire-server	Wolfi	1.14.1-r3

86 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 3.1

5.800000190734863

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N

Affected products

Vendor	Product	Versions
Go	github.com/sigstore/sigstore	0
wolfi	vexctl	0
chainguard	buildkitd	0
wolfi	timestamp-authority	0
chainguard	spire-server-fips	0
chainguard	tekton-pipelines-1.0	0
chainguard	cloudbeat-fips-9.1	0
wolfi	undock	0
chainguard	tkn-fips	0
chainguard	tekton-pipelines-fips-1.3	0
chainguard	prometheus-podman-exporter-fips	0
wolfi	spire-server	0
wolfi	docker-compose	0
chainguard	image-factory	0
chainguard	fulcio-fips	0
chainguard	tflint	0
wolfi	ratify	0
chainguard	buildah	0
chainguard	neuvector-sigstore-interface	0
chainguard	tekton-pipelines-1.6	0

…and 156 more

Timeline

Jan 22, 2026 CVE Published
Mar 24, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-fcv2-xgw5-pqxf
vulnetix vdb fixes GHSA-fcv2-xgw5-pqxf

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-fcv2-xgw5-pqxf/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →