CVE-2026-39395

Description

Cosign provides code signing and transparency for containers and binaries. Prior to 3.0.6 and 2.6.3, cosign verify-blob-attestation may erroneously report a "Verified OK" result for attestations with malformed payloads or mismatched predicate types. For old-format bundles and detached signatures, this was due to a logic flaw in the error handling of the predicate type validation. For new-format bundles, the predicate type validation was bypassed completely. This vulnerability is fixed in 3.0.6 and 2.6.3.

PUBLISHED Reserved 2026-04-06 | Published 2026-04-07 | Updated 2026-04-08 | Assigner GitHub_M

Problem types

CWE-754: Improper Check for Unusual or Exceptional Conditions

Product status

References

github.com/...cosign/security/advisories/GHSA-w6c6-c85g-mmv6

cve.org (CVE-2026-39395)

nvd.nist.gov (CVE-2026-39395)

Download JSON