CVE-2026-44310 gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers
Attackers can bypass Git commit signature verification by crafting empty-certificate PKCS7 messages, causing the tool to exit successfully despite invalid signatures.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-44310?
CVE-2026-44310 is a medium-severity vulnerability in sigstore gitsign, published on 15 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. From 0.4.0 to before 0.15.0, CertVerifier.Verify() in pkg/git/verifier.go unconditionally dereferences certs[0] after sd.GetCertificates() without checking the slice length. A CMS/PKCS7 signed message with an empty certificate set is a structurally valid DER payload; GetCertificates() returns an empty slice with no error, causing an immediate index-out-of-range panic. On the gitsign --verify code path (the GPG-compatible mode invoked by git verify-commit), the panic is silently recovered by internal/io/streams.go's Wrap() function, which returns nil instead of an error. main.go then exits with code 0, causing exit-code-only verification callers to interpret the failed verification as success. This vulnerability is fixed in 0.15.0.
Which versions are affected by CVE-2026-44310?
3 open source packages ship an affected version, including github.com/sigstore/gitsign.
| Package | Affected | Fixed in |
|---|---|---|
github.com/sigstore/gitsign Go | From 0.4.0 | 0.15.0 |
github.com/sigstore/gitsign Go | From 0.4.0 | 0.15.0 |
github.com/sigstore/gitsign Go | From 0.4.0 | 0.15.0 |
How do I fix CVE-2026-44310?
Upgrade github.com/sigstore/gitsign to 0.15.0 or later.
Is CVE-2026-44310 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44310 exists.
Sources
Also known as DEBIAN-CVE-2026-44310, GHSA-7c37-gx6w-8vc5, GO-2026-5212, UBUNTU-CVE-2026-44310.