{"id":"CVE-2026-39395","kind":"vulnerability","aliases":["CVE-2026-39395","GHSA-w6c6-c85g-mmv6"],"related":[],"title":"Cosign's verify-blob-attestation reports false positive when payload parsing fails","description":"## Description\n\n`cosign verify-blob-attestation` may erroneously report a \"Verified OK\" result for attestations with malformed payloads or mismatched predicate types. For old-format bundles and detached signatures, this was due to a logic flaw in the error handling of the predicate type validation. For new-format bundles, the predicate type validation was bypassed completely.\n\n## Impact\n\nWhen `cosign verify-blob-attestation` is used without `--check-claims` set to `true`, an attestation that has a valid signature but a malformed or unparsable payload would be incorrectly validated. Additionally, systems relying on `--type <predicate type>` to reject attestations with mismatched types would be lead to trust the unexpected attestation type.\n\n## Patches\n\nv3.0.6, v2.6.3\n\n## Workarounds\n\nAlways set `--check-claims=true` for attestation verification.","summary":"Cosign's verify-blob-attestation can report \"Verified OK\" for attestations whose payload is malformed or whose predicate type does not match the one requested. An attacker with a validly signed but unparsable attestation can get it accepted as trusted.","severity":"medium","cvss":5.3,"epss":0.0025,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/sigstore/cosign/v3","fixed":["3.0.6"],"affected":">= 3.0.0, < 3.0.6","ecosystem":"go"},{"name":"github.com/sigstore/cosign/v2","fixed":["2.6.3"],"affected":"< 2.6.3","ecosystem":"go"},{"name":"github.com/sigstore/cosign","fixed":[],"affected":"<= 1.13.6","ecosystem":"go"},{"name":"sigstore cosign","fixed":["2.6.3"],"affected":"< 2.6.3","ecosystem":"vendor"},{"name":"sigstore cosign","fixed":["3.0.6"],"affected":">= 3.0.0, < 3.0.6","ecosystem":"vendor"}],"ecosystems":["go","vendor"],"tags":["ci","cosign","cwe-754","go","package","sigstore"],"not_affected_if":["check-claims-enabled","no-blob-attestation-verification"],"how_to_check":"- Check the installed cosign version with `cosign version` or the Go module version in `go.mod` (`github.com/sigstore/cosign/v2` or `/v3`).\n- Look for scripts or CI jobs that run `cosign verify-blob-attestation` and whether they pass `--check-claims=true`.\n- Confirm whether the workflow relies on `--type` to reject attestations of other predicate types.","fix":"- `github.com/sigstore/cosign/v3` (affected >= 3.0.0, < 3.0.6): move to `3.0.6`\n- `github.com/sigstore/cosign/v2` (affected < 2.6.3): move to `2.6.3`\n- `github.com/sigstore/cosign` (affected <= 1.13.6): fixed version unknown","status":"open","published_at":"2026-04-07T20:16:33+00:00","first_seen_at":"2026-11-12T18:20:03+00:00","triaged_at":"2026-11-12T18:21:46+00:00","updated_at":"2026-11-12T18:40:39+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-12T18:21:46Z","model":"claude-haiku-5-5","output":{"fix":"- `github.com/sigstore/cosign/v3` (affected >= 3.0.0, < 3.0.6): move to `3.0.6`\n- `github.com/sigstore/cosign/v2` (affected < 2.6.3): move to `2.6.3`\n- `github.com/sigstore/cosign` (affected <= 1.13.6): fixed version unknown","reach":"unknown","title":"Cosign: blob attestation check passes malformed or mismatched predicate payloads","impact":"medium","summary":"Cosign's verify-blob-attestation can report \"Verified OK\" for attestations whose payload is malformed or whose predicate type does not match the one requested. An attacker with a validly signed but unparsable attestation can get it accepted as trusted.","audience":"developers","category":"package","nicknames":[],"who_cares":["cosign","sigstore","go","ci"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"unexpected attestation trusted as verified, bypassing predicate type checks","analyst_note":"","how_to_check":"- Check the installed cosign version with `cosign version` or the Go module version in `go.mod` (`github.com/sigstore/cosign/v2` or `/v3`).\n- Look for scripts or CI jobs that run `cosign verify-blob-attestation` and whether they pass `--check-claims=true`.\n- Confirm whether the workflow relies on `--type` to reject attestations of other predicate types.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["check-claims-enabled","no-blob-attestation-verification"],"who_is_affected":"Teams that verify blob attestations with cosign's verify-blob-attestation command, especially in signing or release pipelines that trust the predicate type. Exposure is reduced if the command is always run with --check-claims=true, which the advisory gives as a workaround. Teams not using verify-blob-attestation are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000859,"input_tokens":4958,"output_tokens":726,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,23A '-39395':16A,24A '-754':41B '/sigstore/cosign':33A '/sigstore/cosign/v2':30A '/sigstore/cosign/v3':27A 'accept':83B 'addit':177C 'alway':201C 'attack':72B 'attest':6A,50B,56B,79B,91C,100C,150C,161C,184C,195C,208C 'blob':5A,49B,90C,149C 'bundl':112C,136C 'bypass':142C 'c85g':20A 'check':155C,204C 'check-claim':154C,203C 'ci':38B 'claim':156C,205C 'complet':143C 'cosign':1A,35A,37A,39B,45B,87C,146C 'cve':14A,22A 'cwe':40B 'descript':86C 'detach':114C 'due':118C 'erron':93C 'error':125C 'fail':13A 'fals':8A 'flaw':122C 'format':111C,135C 'get':81B 'ghsa':18A 'ghsa-w6c6-c85g-mmv6':17A 'github.com':26A,29A,32A 'github.com/sigstore/cosign':31A 'github.com/sigstore/cosign/v2':28A 'github.com/sigstore/cosign/v3':25A 'go':42B 'handl':126C 'impact':144C 'incorrect':175C 'lead':190C 'logic':121C 'malform':60B,102C,169C 'match':67B 'may':92C 'mismatch':105C,186C 'mmv6':21A 'new':134C 'new-format':133C 'ok':54B,97C 'old':110C 'old-format':109C 'one':69B 'packag':43B 'pars':12A 'patch':197C 'payload':11A,58B,103C,172C 'posit':9A 'predic':63B,106C,129C,138C 'reject':183C 'reli':179C 'report':7A,52B,94C 'request':70B 'result':98C 'set':157C,202C 'sign':76B 'signatur':115C,166C 'sigstor':44B 'sigstore':34A,36A 'system':178C 'true':159C,206C 'trust':85B,192C 'type':64B,107C,130C,139C,181C,187C,196C 'unexpect':194C 'unpars':78B,171C 'use':152C 'v2.6.3':199C 'v3.0.6':198C 'valid':75B,131C,140C,165C,176C 'verif':209C 'verifi':4A,48B,53B,89C,96C,148C 'verify-blob-attest':3A,47B,88C,147C 'w6c6':19A 'whose':57B,62B 'without':153C 'workaround':200C 'would':173C,188C","nicknames":[],"mitigations":[],"who_affected":"Teams that verify blob attestations with cosign's verify-blob-attestation command, especially in signing or release pipelines that trust the predicate type. Exposure is reduced if the command is always run with --check-claims=true, which the advisory gives as a workaround. Teams not using verify-blob-attestation are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["cosign","githubcomsigstorecosign","githubcomsigstorecosignv2","githubcomsigstorecosignv3","sigstorecosign"],"ptokens":["com","cosign","github","sigstore","v2","v3"],"labels":["ci","cosign","cwe754","go","medium","package","sigstore","vendor"],"campaign_type":null,"search_a":"'-2026':15A,23A '-39395':16A,24A '/sigstore/cosign':33A '/sigstore/cosign/v2':30A '/sigstore/cosign/v3':27A 'attest':6A 'blob':5A 'c85g':20A 'cosign':1A,35A,37A 'cve':14A,22A 'fail':13A 'fals':8A 'ghsa':18A 'ghsa-w6c6-c85g-mmv6':17A 'github.com':26A,29A,32A 'github.com/sigstore/cosign':31A 'github.com/sigstore/cosign/v2':28A 'github.com/sigstore/cosign/v3':25A 'mmv6':21A 'pars':12A 'payload':11A 'posit':9A 'report':7A 'sigstore':34A,36A 'verifi':4A 'verify-blob-attest':3A 'w6c6':19A","search_b":"'-754':41B 'accept':83B 'attack':72B 'attest':50B,56B,79B 'blob':49B 'ci':38B 'cosign':39B,45B 'cwe':40B 'get':81B 'go':42B 'malform':60B 'match':67B 'ok':54B 'one':69B 'packag':43B 'payload':58B 'predic':63B 'report':52B 'request':70B 'sign':76B 'sigstor':44B 'trust':85B 'type':64B 'unpars':78B 'valid':75B 'verifi':48B,53B 'verify-blob-attest':47B 'whose':57B,62B","search_c":"'addit':177C 'alway':201C 'attest':91C,100C,150C,161C,184C,195C,208C 'blob':90C,149C 'bundl':112C,136C 'bypass':142C 'check':155C,204C 'check-claim':154C,203C 'claim':156C,205C 'complet':143C 'cosign':87C,146C 'descript':86C 'detach':114C 'due':118C 'erron':93C 'error':125C 'flaw':122C 'format':111C,135C 'handl':126C 'impact':144C 'incorrect':175C 'lead':190C 'logic':121C 'malform':102C,169C 'may':92C 'mismatch':105C,186C 'new':134C 'new-format':133C 'ok':97C 'old':110C 'old-format':109C 'patch':197C 'payload':103C,172C 'predic':106C,129C,138C 'reject':183C 'reli':179C 'report':94C 'result':98C 'set':157C,202C 'signatur':115C,166C 'system':178C 'true':159C,206C 'trust':192C 'type':107C,130C,139C,181C,187C,196C 'unexpect':194C 'unpars':171C 'use':152C 'v2.6.3':199C 'v3.0.6':198C 'valid':131C,140C,165C,176C 'verif':209C 'verifi':89C,96C,148C 'verify-blob-attest':88C,147C 'without':153C 'workaround':200C 'would':173C,188C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-04-06T22:29:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-w6c6-c85g-mmv6","url":"https://github.com/advisories/GHSA-w6c6-c85g-mmv6","severity":"medium","published_at":"2026-04-08T00:15:44+00:00","modified_at":"2026-11-12T18:18:54+00:00","first_seen_at":"2026-11-12T18:20:03+00:00","fetched_at":"2026-11-12T18:25:53+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-39395","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39395","severity":null,"published_at":"2026-04-07T20:16:33+00:00","modified_at":"2026-07-24T21:10:00+00:00","first_seen_at":"2026-11-12T18:40:39+00:00","fetched_at":"2026-11-12T18:40:39+00:00","note":null}],"documents":[{"id":137239,"url":"https://api.github.com/repos/sigstore/cosign/security-advisories/GHSA-w6c6-c85g-mmv6","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":137240,"url":"https://github.com/sigstore/cosign/security/advisories/GHSA-w6c6-c85g-mmv6","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-04-06T22:29:41+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":137241,"url":"https://github.com/sigstore/cosign/pull/4801","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":137242,"url":"https://github.com/sigstore/cosign/commit/f1ad3ee952313be5d74a49d67ba0aa8d0d5e351f","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":137243,"url":"https://github.com/sigstore/cosign/releases/tag/v2.6.3","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":137244,"url":"https://github.com/sigstore/cosign/releases/tag/v3.0.6","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"disclosures":[],"exploit_sources":[{"type":"epss","score":0.0025,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-39395"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}