CVE-2026-39395: Cosign Authentication Bypass Vulnerability

CVE-2026-39395 Overview

CVE-2026-39395 is an Input Validation Error vulnerability in Cosign, the widely-used code signing and transparency tool for containers and binaries. The vulnerability allows the cosign verify-blob-attestation command to erroneously report a "Verified OK" result for attestations that contain malformed payloads or mismatched predicate types, effectively bypassing critical verification controls in the software supply chain security process.

Critical Impact

Attackers could potentially pass malicious attestations through verification checks, undermining the integrity guarantees that Cosign is designed to provide for container images and binary artifacts.

Affected Products

• Cosign versions prior to 3.0.6
• Cosign versions prior to 2.6.3

Discovery Timeline

• 2026-04-07 - CVE CVE-2026-39395 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-39395

Vulnerability Analysis

This vulnerability stems from improper handling of exceptional conditions (CWE-754) in Cosign's attestation verification process. The verify-blob-attestation command is designed to validate that attestations conform to expected formats and predicate types before confirming verification success. However, due to a logic flaw in error handling, the verification process can return successful results even when the underlying validation has failed.

The vulnerability manifests differently depending on the bundle format being processed:

Old-format bundles and detached signatures: A logic flaw in the error handling mechanism causes predicate type validation failures to be improperly caught and ignored, allowing the verification to proceed and report success despite the mismatch.

New-format bundles: The predicate type validation step is completely bypassed, meaning no verification of predicate type conformance occurs at all for these bundle types.

Root Cause

The root cause is improper handling of exceptional conditions (CWE-754) in the predicate type validation logic within the verify-blob-attestation functionality. For old-format bundles, error handling incorrectly suppresses validation failures. For new-format bundles, the validation code path is entirely skipped, creating a complete bypass of the security control.

Attack Vector

The vulnerability is exploitable over the network and requires user interaction, such as a victim running the verification command against an attacker-supplied attestation. An attacker could craft a malicious attestation with:

1. A malformed payload that should fail validation
2. A predicate type that does not match the expected type

When a user or automated pipeline runs cosign verify-blob-attestation against such an attestation, the command may incorrectly return "Verified OK", leading the user to trust an attestation that should have been rejected.

This could be leveraged in supply chain attacks where attackers substitute legitimate attestations with malicious ones that bypass verification checks.

Detection Methods for CVE-2026-39395

Indicators of Compromise

• Unexpected "Verified OK" results from cosign verify-blob-attestation when verifying attestations with unusual or unexpected predicate types
• Attestation payloads that fail to parse correctly when manually inspected but pass Cosign verification
• Supply chain artifacts with attestations that do not match expected predicate type schemas

Detection Strategies

• Implement additional validation layers that independently verify attestation predicate types after Cosign verification
• Compare attestation predicate types against an allowlist of expected types before trusting verification results
• Log all attestation verification operations and audit for discrepancies between expected and actual predicate types

Monitoring Recommendations

• Monitor CI/CD pipelines for unexpected changes in attestation verification behavior after Cosign updates
• Implement alerting on any attestation verification operations that involve non-standard predicate types
• Track Cosign version deployments across your infrastructure to ensure patched versions are in use

How to Mitigate CVE-2026-39395

Immediate Actions Required

• Upgrade Cosign to version 3.0.6 or later for the 3.x branch
• Upgrade Cosign to version 2.6.3 or later for the 2.x branch
• Review any recently verified attestations for potential integrity issues if running vulnerable versions
• Audit CI/CD pipelines that rely on cosign verify-blob-attestation for supply chain security

Patch Information

The Sigstore project has released fixes in Cosign versions 3.0.6 and 2.6.3. The patches correct the error handling logic for old-format bundles and ensure predicate type validation is properly enforced for new-format bundles. For detailed information about the fix, refer to the GitHub Security Advisory.

Workarounds

• Implement additional validation of attestation predicate types using independent tooling before trusting Cosign verification results
• Manually inspect attestation payloads to verify predicate type conformance for high-security workflows
• Consider temporarily disabling automated trust of attestations verified with affected Cosign versions until upgrades are complete

# Upgrade Cosign to patched version
# For 3.x branch:
cosign version # Check current version
go install github.com/sigstore/cosign/v2/cmd/cosign@v3.0.6

# For 2.x branch:
go install github.com/sigstore/cosign/v2/cmd/cosign@v2.6.3

# Verify upgraded version
cosign version