CVE-2026-39395— Cosign's verify-blob-attestation reports false positive when payload parsing fails
Quick assessment
Affected
sigstore cosign
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
cosign是美国Sigstore开源的一个 OCI 注册表中的容器签名、验证和存储。 Cosign 3.0.6之前版本和2.6.3之前版本存在代码问题漏洞，该漏洞源于对格式错误的负载或谓词类型不匹配的验证逻辑缺陷，可能导致错误报告验证成功。
Possible ATT&CK Techniques 1 AI
T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-39395
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cosign's verify-blob-attestation reports false positive when payload parsing fails
Source: CVE Program / CVE List V5
Vulnerability Description
Cosign provides code signing and transparency for containers and binaries. Prior to 3.0.6 and 2.6.3, cosign verify-blob-attestation may erroneously report a "Verified OK" result for attestations with malformed payloads or mismatched predicate types. For old-format bundles and detached signatures, this was due to a logic flaw in the error handling of the predicate type validation. For new-format bundles, the predicate type validation was bypassed completely. This vulnerability is fixed in 3.0.6 and 2.6.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对因果或异常条件的不恰当检查
Source: CVE Program / CVE List V5
Vulnerability Title
cosign 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
cosign是美国Sigstore开源的一个 OCI 注册表中的容器签名、验证和存储。 Cosign 3.0.6之前版本和2.6.3之前版本存在代码问题漏洞，该漏洞源于对格式错误的负载或谓词类型不匹配的验证逻辑缺陷，可能导致错误报告验证成功。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-39395
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-39395
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: cosign
-
CVE-2026-24122
Cosign Certificate Chain Expiry Validation Issue Allows Issu -
CVE-2026-22703
Cosign verification accepts any valid Rekor entry under cert -
CVE-2024-29903
Cosign vulnerable to machine-wide denial of service via mali -
CVE-2024-29902
Cosign vulnerable to system-wide denial of service via malic -
CVE-2023-46737
Possible endless data attack from attacker-controlled regist
Same vendor: sigstore
-
CVE-2026-48702
Rekor has an OOM Condition due to Unbounded gzip Decompressi -
CVE-2026-49478
Fulcio has OIDC Discovery Redirect Following Allows SSRF and -
CVE-2026-48791
Sigstore Java has a vulnerability with bundle verification o -
CVE-2026-54787
sigstore-go fails to check signature timestamps against a si -
CVE-2026-49834
sigstore-go: Multi-log threshold bypass via single compromis
Same weakness: CWE-754
-
CVE-2026-0317
PAN-OS: Denial of Service Vulnerability -
CVE-2026-0318
PAN-OS: Denial of Service (DoS) on Panorama -
CVE-2026-0319
PAN-OS: Improper Input Handling Vulnerability -
CVE-2026-0321
PAN-OS: Denial of Service (DoS) Vulnerabilities in Network S -
CVE-2026-102077
Junos OS: MX Series with SPC3: In a source NAT scenario malf
V. Comments for CVE-2026-39395
No comments yet