Go/github.com/sigstore/sigstore CVE-2026-24137: medium 5.8, EPSS 0.39%
sigstore legacy TUF client allows for arbitrary file writes with target cache path traversal
Action: Upgrade github.com/sigstore/sigstore to 1.10.4 or later.
go get github.com/sigstore/sigstore@v1.10.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.10.4 | - |
Fixed versions
| 1.10.4 |
Sources
- osv: GHSA-fcv2-xgw5-pqxf
- https://github.com/sigstore/sigstore/security/advisories/GHSA-fcv2-xgw5-pqxf
- https://nvd.nist.gov/vuln/detail/CVE-2026-24137
- https://github.com/sigstore/sigstore/commit/8ec410a2993ea78083aecf0e473a85453039496e
- https://github.com/sigstore/sigstore
- https://github.com/sigstore/sigstore/releases/tag/v1.10.4
- https://pkg.go.dev/vuln/GO-2026-4358
CVE-2026-24137 · published · modified · JSON