CVE-2026-49834: Github.com/sigstore/sigstore go Sigstore-go Has A Multi-log Threshold Vulnerability
MODERATECVE-2026-49834 is a MODERATE (CVSS 5.9) sigstore-go has a multi-log threshold vulnerability (CWE-345: Insufficient Verification of Data Authenticity) affecting Github.com/sigstore/sigstore go libraries in the Go ecosystem. The issue involves sigstore-go has a multi-log threshold bypass via single compromised log. Remediation is available by upgrading affected packages to version 1.2.0.
CVE-2026-49834 at a Glance
Security Impact
CVSS: 5.9
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).
How to Fix CVE-2026-49834
To remediate this vulnerability, upgrade all affected Github.com/sigstore/sigstore go dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade github.com/sigstore/sigstore-go to 1.2.0Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/sigstore/sigstore-goHow to Check if You Are Affected
To determine whether your application is affected by CVE-2026-49834, inspect your project dependencies for Github.com/sigstore/sigstore go:
inspect dependencies for github.com/sigstore/sigstore-goAnalyze the terminal output to locate any version of Github.com/sigstore/sigstore go in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.2.0), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-345: Insufficient Verification of Data Authenticity, where the product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data. In Github.com/sigstore/sigstore go, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-49834 Affected Github.com/sigstore/sigstore go Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/sigstore/sigstore-go
|
Go |
< 1.2.0
|
1.2.0
|
References
Frequently Asked Questions
What is CVE-2026-49834?
Which Github.com/sigstore/sigstore go versions are affected?
What version fixes CVE-2026-49834?
Is github.com/sigstore/sigstore-go affected?
What is the CVSS score of CVE-2026-49834?
What CWE is associated with CVE-2026-49834?
How can I check Go dependencies for CVE-2026-49834?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-9vcr-p3rj-q5q6",
"modified" : "2026-07-31T20:17:30Z",
"published" : "2026-07-09T23:20:30Z",
"aliases" : [ "CVE-2026-49834" ],
"summary" : "sigstore-go has a multi-log threshold bypass via single compromised log",
"details" : "### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nA verifier configured with WithTransparencyLog(N>1) or WithSignedCertificateTimestamps(N>1) expected defense-in-depth against the compromise of a single log instance. However, threshold counting counted verified witnesses per-entry or per-validation-path rather than per-log-authority.\n\nAs a result, a single compromised transparency log could forge multiple entries with different indices, and a single compromised CT log could verify multiple times (either across multiple certificate chains or via multiple embedded SCTs), fully satisfying the multi-log threshold requirements and defeating the multi-log policy.\n\nNote that this does not affect Cosign, as Cosign sets a threshold of 1.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nUpgrade to v1.1.5.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nThere is no workaround, beyond relying on trusted logs.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/sigstore/sigstore-go"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "1.2.0"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 1.1.4"
}
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/sigstore/sigstore-go/security/advisories/GHSA-9vcr-p3rj-q5q6"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-49834"
}, {
"type" : "WEB",
"url" : "https://github.com/sigstore/sigstore-go/pull/633"
}, {
"type" : "WEB",
"url" : "https://github.com/sigstore/sigstore-go/commit/dbb07e62623edd5b175fb9dd5a41dcb85a159207"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/sigstore/sigstore-go"
}, {
"type" : "WEB",
"url" : "https://github.com/sigstore/sigstore-go/releases/tag/v1.2.0"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-345", "CWE-347" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2026-07-09T23:20:30Z",
"nvd_published_at" : "2026-07-17T20:17:21Z"
}
}