---
id: "CVE-2026-39395"
page: "https://infrastack.ai/live/CVE-2026-39395"
kind: "vulnerability"
aliases: ["CVE-2026-39395", "GHSA-w6c6-c85g-mmv6"]
title: "Cosign's verify-blob-attestation reports false positive when payload parsing fails"
severity: "medium"
cvss: 5.3
epss: 0.0025
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/sigstore/cosign/v3", "fixed": ["3.0.6"], "affected": ">= 3.0.0, < 3.0.6", "ecosystem": "go"}, {"name": "github.com/sigstore/cosign/v2", "fixed": ["2.6.3"], "affected": "< 2.6.3", "ecosystem": "go"}, {"name": "github.com/sigstore/cosign", "fixed": [], "affected": "<= 1.13.6", "ecosystem": "go"}, {"name": "sigstore cosign", "fixed": ["2.6.3"], "affected": "< 2.6.3", "ecosystem": "vendor"}, {"name": "sigstore cosign", "fixed": ["3.0.6"], "affected": ">= 3.0.0, < 3.0.6", "ecosystem": "vendor"}]
ecosystems: ["go", "vendor"]
tags: ["ci", "cosign", "cwe-754", "go", "package", "sigstore"]
not_affected_if: ["check-claims-enabled", "no-blob-attestation-verification"]
published_at: "2026-04-07T20:16:33+00:00"
first_seen_at: "2026-11-12T18:20:03+00:00"
updated_at: "2026-11-12T18:40:39+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-w6c6-c85g-mmv6", "first_seen_at": "2026-11-12T18:20:03+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39395", "first_seen_at": "2026-11-12T18:40:39+00:00"}]
exploit_sources: [{"type": "epss", "score": 0.0025, "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-39395"}]
---

# Cosign's verify-blob-attestation reports false positive when payload parsing fails

Link for people: https://infrastack.ai/live/CVE-2026-39395 (this .md is for agents)

Cosign's verify-blob-attestation can report "Verified OK" for attestations whose payload is malformed or whose predicate type does not match the one requested. An attacker with a validly signed but unparsable attestation can get it accepted as trusted.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/sigstore/cosign/v3 affected >= 3.0.0, < 3.0.6 fixed 3.0.6
- go:github.com/sigstore/cosign/v2 affected < 2.6.3 fixed 2.6.3
- go:github.com/sigstore/cosign affected <= 1.13.6 fixed no fixed version listed
- vendor:sigstore cosign affected < 2.6.3 fixed 2.6.3
- vendor:sigstore cosign affected >= 3.0.0, < 3.0.6 fixed 3.0.6

## How to check

- Check the installed cosign version with `cosign version` or the Go module version in `go.mod` (`github.com/sigstore/cosign/v2` or `/v3`).
- Look for scripts or CI jobs that run `cosign verify-blob-attestation` and whether they pass `--check-claims=true`.
- Confirm whether the workflow relies on `--type` to reject attestations of other predicate types.

## Fix

- `github.com/sigstore/cosign/v3` (affected >= 3.0.0, < 3.0.6): move to `3.0.6`
- `github.com/sigstore/cosign/v2` (affected < 2.6.3): move to `2.6.3`
- `github.com/sigstore/cosign` (affected <= 1.13.6): fixed version unknown

## Timeline

- 2026-11-12T18:20:03+00:00 ghsa https://github.com/advisories/GHSA-w6c6-c85g-mmv6
- 2026-11-12T18:40:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-39395

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/sigstore/cosign/security-advisories/GHSA-w6c6-c85g-mmv6
- [advisory] Maintainer's advisory: github.com https://github.com/sigstore/cosign/security/advisories/GHSA-w6c6-c85g-mmv6
- [fix] Patch: github.com https://github.com/sigstore/cosign/pull/4801
- [fix] Patch: github.com https://github.com/sigstore/cosign/commit/f1ad3ee952313be5d74a49d67ba0aa8d0d5e351f
- [fix] Release: github.com https://github.com/sigstore/cosign/releases/tag/v2.6.3
- [fix] Release: github.com https://github.com/sigstore/cosign/releases/tag/v3.0.6

## From the sources

## Description

`cosign verify-blob-attestation` may erroneously report a "Verified OK" result for attestations with malformed payloads or mismatched predicate types. For old-format bundles and detached signatures, this was due to a logic flaw in the error handling of the predicate type validation. For new-format bundles, the predicate type validation was bypassed completely.

## Impact

When `cosign verify-blob-attestation` is used without `--check-claims` set to `true`, an attestation that has a valid signature but a malformed or unparsable payload would be incorrectly validated. Additionally, systems relying on `--type <predicate type>` to reject attestations with mismatched types would be lead to trust the unexpected attestation type.

## Patches

v3.0.6, v2.6.3

## Workarounds

Always set `--check-claims=true` for attestation verification.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_