GITHUB.COM/SIGSTORE/COSIGN/V3 · CVE-2026-39395 · Package
FIX → 3.0.6 · 2.6.3
Cosign's verify-blob-attestation can report "Verified OK" for attestations whose payload is malformed or whose predicate type does not match the one requested. An attacker with a validly signed but unparsable attestation can get it accepted as trusted.
first public Apr 6, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that verify blob attestations with cosign's verify-blob-attestation command, especially in signing or release pipelines that trust the predicate type. Exposure is reduced if the command is always run with --check-claims=true, which the advisory gives as a workaround. Teams not using verify-blob-attestation are not affected.
Not affected if check-claims-enabled, no-blob-attestation-verification
Who cares ci, cosign, go, sigstore
cosign version or the Go module version in go.mod ( or ).cosign verify-blob-attestation may erroneously report a "Verified OK" result for attestations with malformed payloads or mismatched predicate types. For old-format bundles and detached signatures, this was due to a logic flaw in the error handling of the predicate type validation. For new-format bundles, the predicate type validation was bypassed completely.
When cosign verify-blob-attestation is used without --check-claims set to true, an attestation that has a valid signature but a malformed or unparsable payload would be incorrectly validated. Additionally, systems relying on --type <predicate type> to reject attestations with mismatched types would be lead to trust the unexpected attestation type.
v3.0.6, v2.6.3
Always set --check-claims=true for attestation verification.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
github.com/sigstore/cosign/v2/v3cosign verify-blob-attestation and whether they pass --check-claims=true.--type to reject attestations of other predicate types.Upgrade to 3.0.6 · 2.6.3
github.com/sigstore/cosign/v3 (affected >= 3.0.0, < 3.0.6): move to 3.0.6github.com/sigstore/cosign/v2 (affected < 2.6.3): move to 2.6.3github.com/sigstore/cosign (affected <= 1.13.6): fixed version unknownThis page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.