CVE-2026-128037 · Package
NO FIX YET · SEE WHAT TO DO
In gittuf 0.10.0 through 0.15.0, when a global minimum-threshold rule and a policy rule cover the same namespace, verification applies the global rule's check over all trusted users instead of the policy rule's authorized users. A user who is trusted but not authorized by the policy rule, or fewer approvers than the threshold, can make changes to the protected namespace that still pass verification.
first public Sep 4, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that use gittuf to verify Git changes and have both a global minimum-threshold rule and a policy rule covering the same namespace are exposed. Repositories without that overlap, or not using gittuf verification, can skip it. The description does not say whether the flaw needs any account access beyond being listed in the policy file.
Not affected if no-overlapping-global-and-policy-rules, not-using-gittuf
Who cares git, gittuf, supply-chain
gittuf version and check whether it reports a version from 0.10.0 through 0.15.0.In gittuf 0.10.0 through 0.15.0, when a minimum threshold global rule and a policy rule protect the same namespace, verification gives the global rule's check over all trusted users in the policy precedence over the policy rule's own authorized users. A user listed in the policy file but not authorized by the policy rule, or fewer users than the rule's threshold, can make changes to the protected namespace that pass verification.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.