Sigstore vulnerabilities
We track 15 vulnerabilities in Sigstore products across 9 products. 15 are rated high or critical, and none are known to be exploited. The most recent was published on October 29, 2026.
Latest Sigstore vulnerabilities
- 7.4 High severity
sigstore-js: Insufficiently Protected Credentials
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.2, packages/oci/src/registry.ts contains a RegistryClient.signIn() method that stores registry Authorization and Docker configuration headers as defaults on a shared
- 7.5 High severity
rekor: Allocation of Resources Without Limits or Throttling
Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the `Package.Unmarshal()` function in `pkg/types/alpine/apk.go` decompresses the signature and control gzip members of an APK file into in-memory buffers w
- 8.7 High severity
fulcio: Server-Side Request Forgery
Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a malicious
- 7.5 High severity
sigstore-go: Improper Verification of Cryptographic Signature
sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.0, a verifier configured with WithTransparencyLog(N>1) or WithSignedCertificateTimestamps(N>1) counts verified witnesses per entry or per validation path rather than per log author
- 7.5 High severity
timestamp-authority: Allocation of Resources Without Limits or Throttling
Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.1.0, the global wrapMetrics middleware records raw HTTP request path r.URL.Path and raw HTTP request method r.Method as Prometheus labels for latency and request count metric
- 7.5 High severity
sigstore-js: Improper Verification of Cryptographic Signature
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in sigstore.verify() is accepted by the public API but discarded before verification, so required certificate extension OIDs
- 9.6 Critical severity
sigstore-js: Insufficiently Protected Credentials
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.1, getRegistryCredentials() reads credentials from the Docker config file and selects an entry by checking whether any configured auth key contains the target regist
- 7.5 High severity
sigstore-ruby: Unchecked Return Value
sigstore-ruby is a pure Ruby implementation of the sigstore verify command from the sigstore/cosign project. Prior to 0.2.3, Sigstore::Verifier#verify does not propagate the VerificationFailure returned by verify_in_toto when the artifact digest does not match
- 7.5 High severity
timestamp-authority: Asymmetric Resource Consumption (Amplification)
Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.0.3, Function api.ParseJSONRequest currently splits (via a call to strings.Split) an optionally-provided OID (which is untrusted data) on periods. Similarly, function api.get
- 7.5 High severity
fulcio: Asymmetric Resource Consumption (Amplification)
Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.3, function identity.extractIssuerURL splits (via a call to strings.Split) its argument (which is untrusted data) on periods
- 7.5 High severity
sigstore-go: Loop with Unreachable Exit Condition
sigstore-go, a Go library for Sigstore signing and verification, is susceptible to a denial of service attack in versions prior to 0.6.1 when a verifier is provided a maliciously crafted Sigstore Bundle containing large amounts of verifiable data, in the form
- 7.5 High severity
cosign: Allocation of Resources Without Limits or Throttling
Cosign provides code signing and transparency for containers and binaries. Prior to version 2.2.4, maliciously-crafted software artifacts can cause denial of service of the machine running Cosign thereby impacting all services on the machine. The root cause is
- 7.5 High severity
rekor: Allocation of Resources Without Limits or Throttling
Rekor is an open source software supply chain transparency log. Rekor prior to version 1.1.1 may crash due to out of memory (OOM) conditions caused by reading archive metadata files into memory without checking their sizes first. Verification of a JAR file sub
- 8.8 High severity
policy-controller: Improper Verification of Cryptographic Signature
PolicyController is a utility used to enforce supply chain policy in Kubernetes clusters. In versions prior to 0.2.1 PolicyController will report a false positive, resulting in an admission when it should not be admitted when there is at least one attestation
- 9.8 Critical severity
cosign: Improper Verification of Cryptographic Signature
cosign is a container signing and verification utility. In versions prior to 1.10.1 cosign can report a false positive if any attestation exists. `cosign verify-attestation` used with the `--type` flag will report a false positive verification when there is at