CVE-2026-24122 Cosign Certificate Chain Expiry Validation Issue Allows Issuing Certificate Expiry to Be Overlooked

What is CVE-2026-24122?

CVE-2026-24122 is a low-severity vulnerability in sigstore cosign, published on 19 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Cosign provides code signing and transparency for containers and binaries. In versions 3.0.4 and below, an issuing certificate with a validity that expires before the leaf certificate will be considered valid during verification even if the provided timestamp would mean the issuing certificate should be considered expired. When verifying artifact signatures using a certificate, Cosign first verifies the certificate chain using the leaf certificate's "not before" timestamp and later checks expiry of the leaf certificate using either a signed timestamp provided by the Rekor transparency log or from a timestamp authority, or using the current time. The root and all issuing certificates are assumed to be valid during the leaf certificate's validity. There is no impact to users of the public Sigstore infrastructure. This may affect private deployments with customized PKIs. This issue has been fixed in version 3.0.5.

Weakness: CWE-295

Which versions are affected by CVE-2026-24122?

6 open source packages ship an affected version, including github.com/sigstore/cosign, cosign and github.com/sigstore/cosign/v2. It affects 1 product.

Products include Sigstore Cosign.

How do I fix CVE-2026-24122?

Upgrade github.com/sigstore/cosign to 3.0.5 or later.

Is CVE-2026-24122 being exploited?

There is no known exploitation of CVE-2026-24122 in the wild and no public exploit code.

Other vulnerabilities in sigstore cosign

• CVE-2022-35929 False positive signature verification in cosign High 7.1
• CVE-2026-22703 Cosign verification accepts any valid Rekor entry under certain conditions Medium 5.5
• CVE-2022-36056 Vulnerabilities with blob verification in sigstore cosign Medium 5.5
• CVE-2026-39395 Cosign's verify-blob-attestation reports false positive when payload parsing fails Medium 4.3
• CVE-2024-29902 Cosign vulnerable to system-wide denial of service via malicious attachments Medium 4.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-cosign-2026-24122, CLEANSTART-2026-FA45866, DEBIAN-CVE-2026-24122, GHSA-wfqv-66vq-46rm, GO-2026-4529, MINI-297f-vwqh-3p5h and 34 more.