CVE-2026-49834 sigstore-go: Multi-log threshold bypass via single compromised log
A single compromised transparency log can bypass multi-log verification thresholds in the sigstore-go library, undermining supply chain integrity guarantees.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-49834?
CVE-2026-49834 is a medium-severity vulnerability in sigstore-go, published on 17 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.0, a verifier configured with WithTransparencyLog(N>1) or WithSignedCertificateTimestamps(N>1) counts verified witnesses per entry or per validation path rather than per log authority, allowing a single compromised transparency log or CT log to satisfy multi-log threshold requirements and defeat the multi-log policy. This issue is fixed in version 1.2.0.
Weakness: CWE-347
Which versions are affected by CVE-2026-49834?
3 open source packages ship an affected version, including github.com/sigstore/sigstore-go. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/sigstore/sigstore-go Go | All versions | 1.2.0 |
github.com/sigstore/sigstore-go Go | All versions | 1.2.0 |
github.com/sigstore/sigstore-go Go | All versions | 1.2.0 |
Products include Sigstore Sigstore-Go.
How do I fix CVE-2026-49834?
Upgrade github.com/sigstore/sigstore-go to 1.2.0 or later.
Is CVE-2026-49834 being exploited?
There is no known exploitation of CVE-2026-49834 in the wild and no public exploit code.
Other vulnerabilities in sigstore-go
Sources
Also known as CLEANSTART-2026-OE12981, CLEANSTART-2026-OY65007, DEBIAN-CVE-2026-49834, GHSA-9vcr-p3rj-q5q6, GO-2026-5952, MINI-24c8-8xp2-pcj5 and 68 more.