CVE-2026-54787

ADVISORY - github

Summary

sigstore-go fails to check signature timestamps against a signing key's validity period for self-managed long-lived keys without certificates.

Impact

To verify a bundle with a self-managed long-lived key, the key needs to be wrapped in an ExpiringKey type that implies expiration semantics:

signatureVerifier, _ := signature.LoadDefaultVerifier(publicKey)
expiredKey := root.NewExpiringKey(signatureVerifier, time.Unix(0, 0), time.Unix(1, 0))

Despite the API contract, the validator does not check the bundle signing time against the validity window. Attackers that obtain expired key materials may be able to sign bundles with those materials that are accepted despite a configured expiry date. This issue only impacts the long-lived signing key workflow, and not standard deployments involving a certificate authority.

Reproduction steps

Start from a sigstore-go checkout:

git clone https://github.com/sigstore/sigstore-go.git
cd sigstore-go
git checkout 8ca80c47ef03d26ebf174db7c296700b075b2c16

Apply the patch containing the test case and associated materials:

git apply sigstore-go-public-key-validity-test.patch

Run the test:

go test ./pkg/verify -run TestPublicKeyValidityCheckedAgainstSignedTimestamp

On vulnerable code, the test fails because verification succeeds even though the trusted ExpiringKey is not valid at the signed timestamp:

--- FAIL: TestPublicKeyValidityCheckedAgainstSignedTimestamp
    signed_entity_test.go:602:
            Error:      	An error is expected but got nil.

EPSS Score⁠: 0.0009 (0.005)

Common Weakness Enumeration (CWE)

ADVISORY - github

CWE-324⁠

Use of a Key Past its Expiration Date

Impacted images

Advisories

GitHub

CREATED

23 days ago

UPDATED

23 days ago

ADVISORY IDGHSA-wqqc-jjcq-vfxm⁠

EXPLOITABILITY SCORE

1.6

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)

CWE-324⁠

CVSS SCORE

3.1low

Debian

CREATED

23 days ago

UPDATED

5 days ago

ADVISORY IDCVE-2026-54787⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

Ubuntu

CREATED

19 days ago

UPDATED

19 days ago

ADVISORY IDCVE-2026-54787⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Amedium

GoLang

CREATED

5 days ago

UPDATED

5 days ago

ADVISORY IDGO-2026-6162⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

Chainguard

CREATED

10 days ago

UPDATED

10 days ago

ADVISORY ID

CGA-wxx3-qjx8-5q63

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

20 days ago

UPDATED

20 days ago

ADVISORY ID

MINI-229j-wj9j-43r5

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

22 days ago

UPDATED

22 days ago

ADVISORY ID

MINI-27xv-p98c-r2gm

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

20 days ago

UPDATED

20 days ago

ADVISORY ID

MINI-2v5j-x6v8-rjm8

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

22 days ago

UPDATED

22 days ago

ADVISORY ID

MINI-2vj2-w2m8-57hx

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

22 days ago

UPDATED

22 days ago

ADVISORY ID

MINI-36v2-5g7v-m4p4

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

20 days ago

UPDATED

20 days ago

ADVISORY ID

MINI-3c44-m93v-rjq8

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

11 days ago

UPDATED

11 days ago

ADVISORY ID

MINI-3mgc-grp3-2mm6

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

21 days ago

UPDATED

21 days ago

ADVISORY ID

MINI-3r5x-wj8c-7fvx

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

20 days ago

UPDATED

20 days ago

ADVISORY ID

MINI-3xxg-98q6-hcjc

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

21 days ago

UPDATED

21 days ago

ADVISORY ID

MINI-423x-mw4h-4mmp

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

20 days ago

UPDATED

20 days ago

ADVISORY ID

MINI-4rfw-8mq9-r6x8

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

20 days ago

UPDATED

20 days ago

ADVISORY ID

MINI-4rvh-7hff-575x

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

21 days ago

UPDATED

21 days ago

ADVISORY ID

MINI-4w32-mggp-qw24

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

20 days ago

UPDATED

20 days ago

ADVISORY ID

MINI-5hhr-w7jr-hq4p

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

21 days ago

UPDATED

21 days ago

ADVISORY ID

MINI-5rcw-wqwp-h85m

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

22 days ago

UPDATED

22 days ago

ADVISORY ID

MINI-68mj-57vg-jwh8

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

22 days ago

UPDATED

22 days ago

ADVISORY ID

MINI-69cc-pjcw-wq5h

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

18 days ago

UPDATED

18 days ago

ADVISORY ID

MINI-6ggr-wj9f-p9f6

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

20 days ago

UPDATED

20 days ago

ADVISORY ID

MINI-6gj9-c64h-f5p2

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

22 days ago

UPDATED

22 days ago

ADVISORY ID

MINI-6phm-j52w-g5ph

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

22 days ago

UPDATED

22 days ago

ADVISORY ID

MINI-6r2q-fqxj-c8h3

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

22 days ago

UPDATED

22 days ago

ADVISORY ID

MINI-74x9-3qx8-2qw9

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

21 days ago

UPDATED

21 days ago

ADVISORY ID

MINI-7874-ffjx-vwrf

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

21 days ago

UPDATED

21 days ago

ADVISORY ID

MINI-7hm9-p8qp-vqgm

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

21 days ago

UPDATED

21 days ago

ADVISORY ID

MINI-86gv-hqvr-42hv

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

21 days ago

UPDATED

21 days ago

ADVISORY ID

MINI-8jm3-5jv3-3qf8

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

20 days ago

UPDATED

20 days ago

ADVISORY ID

MINI-9583-6hv2-gpfc

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

20 days ago

UPDATED

20 days ago

ADVISORY ID

MINI-9hhp-rv9g-h5wr

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

22 days ago

UPDATED

22 days ago

ADVISORY ID

MINI-9q56-m8h5-jrmq

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

22 days ago

UPDATED

22 days ago

ADVISORY ID

MINI-c2m7-ffh8-phvw

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

22 days ago

UPDATED

22 days ago

ADVISORY ID

MINI-cf25-f898-x3w9

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

20 days ago

UPDATED

20 days ago

ADVISORY ID

MINI-cm4w-rcq7-479m

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

21 days ago

UPDATED

21 days ago

ADVISORY ID

MINI-cpmc-m742-5wv9

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

21 days ago

UPDATED

21 days ago

ADVISORY ID

MINI-cx33-pfr9-c87m

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

22 days ago

UPDATED

22 days ago

ADVISORY ID

MINI-f2j7-pmp9-9rjh

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

21 days ago

UPDATED

21 days ago

ADVISORY ID

MINI-f43x-65j2-76r6

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

22 days ago

UPDATED

22 days ago

ADVISORY ID

MINI-f68g-82mj-hc9c

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

3 days ago

UPDATED

3 days ago

ADVISORY ID

MINI-fw5g-r962-hj7q

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

20 days ago

UPDATED

20 days ago

ADVISORY ID

MINI-g43h-6vpw-qpg3

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

21 days ago

UPDATED

21 days ago

ADVISORY ID

MINI-g7w5-wx7j-943c

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

21 days ago

UPDATED

21 days ago

ADVISORY ID

MINI-gwq3-65rg-w73r

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

20 days ago

UPDATED

20 days ago

ADVISORY ID

MINI-h2cj-87g9-hjfv

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

20 days ago

UPDATED

20 days ago

ADVISORY ID

MINI-h5x2-7gmw-534j

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

21 days ago

UPDATED

21 days ago

ADVISORY ID

MINI-hx64-vgv5-7mvp

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

21 days ago

UPDATED

21 days ago

ADVISORY ID

MINI-j39c-qvrv-fh93

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

20 days ago

UPDATED

20 days ago

ADVISORY ID

MINI-j8vw-46h6-cmwh

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

21 days ago

UPDATED

21 days ago

ADVISORY ID

MINI-jjv6-5hcm-ccgj

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

21 days ago

UPDATED

21 days ago

ADVISORY ID

MINI-m46w-935c-p5cp

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

22 days ago

UPDATED

22 days ago

ADVISORY ID

MINI-m6rx-9r6x-rw54

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

22 days ago

UPDATED

22 days ago

ADVISORY ID

MINI-mfxj-ff9h-x8qp

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

20 days ago

UPDATED

20 days ago

ADVISORY ID

MINI-pfg6-89p6-98wm

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

18 days ago

UPDATED

18 days ago

ADVISORY ID

MINI-phph-9fmm-7489

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

22 days ago

UPDATED

22 days ago

ADVISORY ID

MINI-pv2h-jqvm-4wm3

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

22 days ago

UPDATED

22 days ago

ADVISORY ID

MINI-q42j-7cfq-pq9g

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

19 days ago

UPDATED

19 days ago

ADVISORY ID

MINI-qh7p-3q3j-8566

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

22 days ago

UPDATED

22 days ago

ADVISORY ID

MINI-qj92-wfmm-hj6p

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

20 days ago

UPDATED

20 days ago

ADVISORY ID

MINI-qqjc-vj55-hrv2

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

22 days ago

UPDATED

22 days ago

ADVISORY ID

MINI-rjvf-5q35-hw3p

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

22 days ago

UPDATED

22 days ago

ADVISORY ID

MINI-v2wr-3733-qph6

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

21 days ago

UPDATED

21 days ago

ADVISORY ID

MINI-vg5h-jhxg-98qm

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

21 days ago

UPDATED

21 days ago

ADVISORY ID

MINI-vvjm-jwjv-x959

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

11 days ago

UPDATED

11 days ago

ADVISORY ID

MINI-w62p-rcmx-22pc

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

22 days ago

UPDATED

22 days ago

ADVISORY ID

MINI-w7h9-xvf9-r6mg

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

22 days ago

UPDATED

22 days ago

ADVISORY ID

MINI-w8hm-682m-66xv

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

21 days ago

UPDATED

21 days ago

ADVISORY ID

MINI-x388-c72x-m9qq

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

22 days ago

UPDATED

22 days ago

ADVISORY ID

MINI-x3gf-8j2j-xprv

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

20 days ago

UPDATED

20 days ago

ADVISORY ID

MINI-x5cm-x6x2-5624

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

11 days ago

UPDATED

11 days ago

ADVISORY ID

MINI-xg2q-jhrm-4848

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

22 days ago

UPDATED

22 days ago

ADVISORY ID

MINI-xvpq-v2v3-m5p9

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY