---
id: "CVE-2026-128037"
page: "https://infrastack.ai/live/CVE-2026-128037"
kind: "vulnerability"
aliases: ["CVE-2026-128037"]
title: "gittuf: global threshold rule lets unauthorized users pass verification"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["git", "gittuf", "package", "supply-chain"]
not_affected_if: ["no-overlapping-global-and-policy-rules", "not-using-gittuf"]
published_at: "2026-11-13T16:18:59+00:00"
first_seen_at: "2026-11-13T16:47:33+00:00"
updated_at: "2026-11-13T16:48:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-128037", "first_seen_at": "2026-11-13T16:47:33+00:00"}]
exploit_sources: []
---

# gittuf: global threshold rule lets unauthorized users pass verification

Link for people: https://infrastack.ai/live/CVE-2026-128037 (this .md is for agents)

In gittuf 0.10.0 through 0.15.0, when a global minimum-threshold rule and a policy rule cover the same namespace, verification applies the global rule's check over all trusted users instead of the policy rule's authorized users. A user who is trusted but not authorized by the policy rule, or fewer approvers than the threshold, can make changes to the protected namespace that still pass verification.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `gittuf version` and check whether it reports a version from `0.10.0` through `0.15.0`.
- Look for a global minimum-threshold rule and a policy rule that protect the same namespace in the gittuf policy.

## Fix

- gittuf: unknown (the sources list a fix link, but the fixed version was not stated in the text provided)

## Timeline

- 2026-11-13T16:47:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-128037

## Documents

- [advisory] Vendor advisory: github.com https://github.com/gittuf/gittuf/security/advisories/GHSA-qc8j-pcph-6q9x
- [fix] Release notes: github.com https://github.com/gittuf/gittuf/releases/tag/v0.16.0

## From the sources

In gittuf 0.10.0 through 0.15.0, when a minimum threshold global rule and a policy rule protect the same namespace, verification gives the global rule's check over all trusted users in the policy precedence over the policy rule's own authorized users. A user listed in the policy file but not authorized by the policy rule, or fewer users than the rule's threshold, can make changes to the protected namespace that pass verification.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_