VDB
GO-2026-4309
GO-2026-4309
PUBLISHED
Cosign verification accepts any valid Rekor entry under certain conditions in github.com/sigstore/cosign
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| chainguard | cloudbeat-fips-9.4 | 0, 0, 0 |
| chainguard | kyverno-policy-reporter-plugins-kyverno | 0, 0, 0 |
| wolfi | policy-controller | 0, 0, 0 |
| chainguard | chainctl | 0, 0, 0 |
| chainguard | teleport-18.6 | 0, 0, 0 |
| chainguard | tkn | 0, 0, 0 |
| chainguard | cloudbeat-9.4 | 0, 0, 0 |
| wolfi | ratify | 0, 0, 0 |
| wolfi | zot | 0, 0, 0 |
| chainguard | tkn-fips | 0, 0, 0 |
| chainguard | tekton-chains-fips | 0, 0, 0 |
| chainguard | cloudbeat-9.2 | 0, 0, 0 |
| chainguard | cloudbeat-8.19 | 0, 0, 0 |
| wolfi | kyverno-notation-aws | 0, 0, 0 |
| chainguard | policy-controller-fips | 0, 0, 0 |
| wolfi | teleport-18.6 | 0, 0, 0 |
| wolfi | goreleaser | 0, 0, 0 |
| chainguard | ratify | 0, 0, 0 |
| chainguard | zot | 0, 0, 0 |
| wolfi | aactl | 0, 0, 0 |
…and 28 more
Timeline
- Jan 13, 2026 CVE Published
- Aug 24, 2026 CVE Updated
- Sep 1, 2026 Security Advisory