CVE-2026-48791

LowCVSS 2.0

Published: 13/08/2026(UTC)Updated: 13/08/2026(UTC)Translated: 13/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.06%

0th percentile - higher than 0% of all known CVEs

Summary

Version 2.0.0 of the sigstore-java library erroneously removed verification of the integrated (Rekor entry) time against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements adhering to the Sigstore verification spec. The vulnerability affects only users verifying bundles with dev.sigstore:sigstore-java:2.0.0.

Risk Assessment

An attacker who gains access to a user's system and exfiltrates the temporary private key used during signing could later reuse an old Fulcio certificate without direct access to the user's credentials, potentially leading to unauthorized signing of artifacts.

Recommendation

Users should re-verify their artifacts using the newest sigstore-java (2.1.0) or another current sigstore client. Transparency logs should also be audited for unauthorized signatures for a suspected reused identity.

Original NVD description (English source)

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated (Rekor entry) time) against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verification spec. The old sigstore-conformance test for this check was built incorrectly. This vulnerability impacts only users verifying bundles with `dev.sigstore:sigstore-java:2.0.0`. Older versions are not affected; it is fixed in `dev.sigstore:sigstore-java:2.1.0` A malicious actor may exploit this if they were able to access a users system and exfiltrate the temporary private key used during signing and then reuse an old fulcio certificate later without requiring direct access to the user's credentials. Users may protect themselves by re-verifying their artifacts using the newest sigstore-java or another current sigstore client. Transparency logs may also be audited for unauthorized signatures for a suspected reused identity.