CVE-2026-48815 sigstore-js: `certificateOIDs` verification constraints are silently dropped and never enforced
Applications using sigstore-js with certificateOIDs constraints fail to enforce them, allowing acceptance of unauthorized signing certificates.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-48815?
CVE-2026-48815 is a high-severity vulnerability in sigstore-js, published on 14 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in sigstore.verify() is accepted by the public API but discarded before verification, so required certificate extension OIDs are never checked and applications relying on certificateOIDs to restrict which certificates may sign artifacts can accept unauthorized certificates. This issue is fixed in version 4.1.1.
Weakness: CWE-347
Which versions are affected by CVE-2026-48815?
2 open source packages ship an affected version, including sigstore.
| Package | Affected | Fixed in |
|---|---|---|
sigstore npm | All versions | 4.1.1 |
sigstore npm | All versions | 4.1.1 |
How do I fix CVE-2026-48815?
Upgrade sigstore to 4.1.1 or later.
Is CVE-2026-48815 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-48815 exists.
Sources
Also known as CLEANSTART-2026-AZ47953, CLEANSTART-2026-YO55047, CLEANSTART-2026-ZU97983, CLSA-2026-1791840004, CLSA-2026-1792582435, GHSA-52v5-jr5w-gjxr and 8 more.