CVE-2026-54787: sigstore-go Auth Bypass Vulnerability

CVE-2026-54787 Overview

CVE-2026-54787 affects sigstore-go, a Go library used for Sigstore signing and verification. Versions prior to 1.2.1 fail to check a bundle signing timestamp against the validity window of an ExpiringKey that wraps a self-managed, long-lived signing key without a certificate. An attacker who possesses expired key material can therefore produce bundles that verifiers still accept as valid. The flaw is categorized under CWE-324: Use of a Key Past its Expiration Date. Maintainers addressed the issue in sigstore-go version 1.2.1.

Critical Impact
An attacker holding expired long-lived signing key material can produce Sigstore bundles that pass verification, undermining the integrity guarantees of software supply chain artifacts signed with self-managed keys.

Affected Products

sigstore-go library versions prior to 1.2.1
Applications and pipelines consuming sigstore-go for Sigstore bundle verification with self-managed long-lived keys
Downstream tooling embedding vulnerable sigstore-go releases as a dependency

Discovery Timeline

2026-07-31 - CVE-2026-54787 published to NVD
2026-08-01 - Last updated in NVD database

Technical Details for CVE-2026-54787

Vulnerability Analysis

Sigstore bundles can be signed with either short-lived certificates issued by Fulcio or self-managed long-lived public keys wrapped by an ExpiringKey. The verification path in sigstore-go correctly enforced the validity window when a certificate was present, but did not perform an equivalent check when the signer used a raw public key with an associated expiration. As a result, a verified timestamp from a signed timestamp authority or transparency log entry was never compared against the key's NotAfter boundary. A bundle produced after the key's expiration could still satisfy the verifier, breaking the temporal integrity model that Sigstore relies on.

Root Cause

The root cause is a missing conditional branch in pkg/verify/signed_entity.go. The verifier evaluated signed certificate timestamps against certificate validity, but had no else if branch to handle bundles whose verificationContent exposed only a PublicKey(). Because ValidAtTime was never invoked for the long-lived key case, the trusted material's expiration metadata was ignored during timestamp validation.

Attack Vector

Exploitation requires an attacker to already possess expired key material corresponding to a public key that a verifier trusts. The attacker signs an arbitrary artifact, assembles a Sigstore bundle, and obtains a valid timestamp for the signature. Because the verifier never compares that timestamp against the key's expiration, the malicious bundle is accepted. The impact is limited to integrity of signed artifacts; confidentiality and availability are not affected.

				return nil, fmt.Errorf("failed to verify signed certificate timestamp: %w", err)
			}
		}
	} else if verificationContent.PublicKey() != nil {
		// If the bundle was signed by a long-lived key, we need to check the signature time against the key's validity window.
		for _, verifiedTs := range verifiedTimestamps {
			if !verificationContent.ValidAtTime(verifiedTs.Timestamp, v.trustedMaterial) {
				return nil, errors.New("signature time outside of public key validity window")
			}
		}
	}

	// If SCTs are required, ensure the bundle is certificate-signed not public key-signed

Source: sigstore/sigstore-go commit 4594ab4 — the patch adds the missing ValidAtTime check that rejects signatures produced outside the public key's validity window.

Detection Methods for CVE-2026-54787

Indicators of Compromise

Sigstore bundles that verify successfully despite carrying a signature timestamp later than the trusted public key's NotAfter value.
Artifact provenance records referencing an ExpiringKey whose material is known to have been rotated or revoked.
Unexpected releases or attestations signed by long-lived keys that were retired from the trusted material set.

Detection Strategies

Inventory build and verification tooling to identify any component pinning sigstore-go at a version below 1.2.1.
Re-verify recently accepted bundles using sigstore-go1.2.1 or later and flag any that now fail with signature time outside of public key validity window.
Cross-reference signing timestamps in stored attestations against the historical validity windows of trusted long-lived keys.

Monitoring Recommendations

Log every Sigstore verification result, including the resolved signer identity, signature timestamp, and key expiration metadata, for later correlation.
Alert on verification pipelines that continue to consume the vulnerable sigstore-go versions after remediation windows close.
Monitor code repositories and container registries for provenance attestations whose signer public keys have exceeded their scheduled rotation date.

How to Mitigate CVE-2026-54787

Immediate Actions Required

Upgrade all direct and transitive dependencies on sigstore-go to version 1.2.1 or later.
Rebuild and redeploy any binaries, CLIs, or services that statically link the vulnerable library.
Rotate self-managed long-lived signing keys if there is any suspicion that expired key material was retained by an untrusted party.

Patch Information

The fix is available in sigstore-go v1.2.1 and was introduced by pull request #642. See the GHSA-wqqc-jjcq-vfxm advisory for the maintainer disclosure. The patch adds an else if verificationContent.PublicKey() != nil branch that iterates verified timestamps and rejects any signature produced outside the public key's validity window.

Workarounds

Prefer short-lived Fulcio-issued certificates over self-managed long-lived keys until the library upgrade is deployed.
Enforce out-of-band checks that compare stored signature timestamps against the current trusted key set before promoting artifacts.
Shorten rotation intervals for ExpiringKey-wrapped signing keys to reduce the window in which expired material remains usable.

bash

# Update the sigstore-go dependency to the patched release
go get github.com/sigstore/sigstore-go@v1.2.1
go mod tidy

# Verify the resolved version
go list -m github.com/sigstore/sigstore-go