CVE-2026-54787: Github.com/sigstore/sigstore go Sigstore-go Fails To Check Signature Vulnerability
LOWCVE-2026-54787 is a LOW (CVSS 3.1) sigstore-go fails to check signature vulnerability (CWE-324: Use of a Key Past its Expiration Date) affecting Github.com/sigstore/sigstore go libraries in the Go ecosystem. The issue involves sigstore-go fails to check signature timestamps against a signing key's validity period. Remediation is available by upgrading affected packages to version 1.2.1.
CVE-2026-54787 at a Glance
Security Impact
CVSS: 3.1
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N).
How to Fix CVE-2026-54787
To remediate this vulnerability, upgrade all affected Github.com/sigstore/sigstore go dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade github.com/sigstore/sigstore-go to 1.2.1Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/sigstore/sigstore-goHow to Check if You Are Affected
To determine whether your application is affected by CVE-2026-54787, inspect your project dependencies for Github.com/sigstore/sigstore go:
inspect dependencies for github.com/sigstore/sigstore-goAnalyze the terminal output to locate any version of Github.com/sigstore/sigstore go in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.2.1), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-324: Use of a Key Past its Expiration Date, where the product uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing window for cracking attacks against that key. In Github.com/sigstore/sigstore go, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-54787 Affected Github.com/sigstore/sigstore go Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/sigstore/sigstore-go
|
Go |
< 1.2.1
|
1.2.1
|
References
Frequently Asked Questions
What is CVE-2026-54787?
Which Github.com/sigstore/sigstore go versions are affected?
What version fixes CVE-2026-54787?
Is github.com/sigstore/sigstore-go affected?
What is the CVSS score of CVE-2026-54787?
What CWE is associated with CVE-2026-54787?
How can I check Go dependencies for CVE-2026-54787?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-wqqc-jjcq-vfxm",
"modified" : "2026-07-31T21:58:39Z",
"published" : "2026-07-31T21:58:39Z",
"aliases" : [ "CVE-2026-54787" ],
"summary" : "sigstore-go fails to check signature timestamps against a signing key's validity period",
"details" : "sigstore-go fails to check signature timestamps against a signing key's validity period for self-managed long-lived keys without certificates.\n\n## Impact\n\nTo verify a bundle with a self-managed long-lived key, the key needs to be wrapped in an `ExpiringKey` type that implies expiration semantics:\n\n```go\nsignatureVerifier, _ := signature.LoadDefaultVerifier(publicKey)\nexpiredKey := root.NewExpiringKey(signatureVerifier, time.Unix(0, 0), time.Unix(1, 0))\n```\n\nDespite the API contract, the validator does not check the bundle signing time against the validity window. Attackers that obtain expired key materials may be able to sign bundles with those materials that are accepted despite a configured expiry date. This issue only impacts the long-lived signing key workflow, and not standard deployments involving a certificate authority.\n\n## Reproduction steps\n\nStart from a sigstore-go checkout:\n\n```bash\ngit clone https://github.com/sigstore/sigstore-go.git\ncd sigstore-go\ngit checkout 8ca80c47ef03d26ebf174db7c296700b075b2c16\n```\n\nApply the [patch] containing the test case and associated materials:\n\n```bash\ngit apply sigstore-go-public-key-validity-test.patch\n```\n\nRun the test:\n\n```bash\ngo test ./pkg/verify -run TestPublicKeyValidityCheckedAgainstSignedTimestamp\n```\n\nOn vulnerable code, the test fails because verification succeeds even though the trusted `ExpiringKey` is not valid at the signed timestamp:\n\n```text\n--- FAIL: TestPublicKeyValidityCheckedAgainstSignedTimestamp\n signed_entity_test.go:602:\n \tError: \tAn error is expected but got nil.\n```\n\n[patch]: https://github.com/user-attachments/files/28614520/sigstore-go-public-key-validity-test.patch",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/sigstore/sigstore-go"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "1.2.1"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 1.2.0"
}
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm"
}, {
"type" : "WEB",
"url" : "https://github.com/sigstore/sigstore-go/pull/642"
}, {
"type" : "WEB",
"url" : "https://github.com/sigstore/sigstore-go/commit/4594ab4c779d08be1f4419803a8249188f35ed5f"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/sigstore/sigstore-go"
}, {
"type" : "WEB",
"url" : "https://github.com/sigstore/sigstore-go/releases/tag/v1.2.1"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-324" ],
"severity" : "LOW",
"github_reviewed" : true,
"github_reviewed_at" : "2026-07-31T21:58:39Z",
"nvd_published_at" : null
}
}