Go/github.com/sigstore/sigstore CVE-2026-24137: unknown, EPSS 0.39%
Sigstore legacy TUF client allows for arbitrary file writes with target cache path traversal in github.com/sigstore/sigstore
Action: Upgrade github.com/sigstore/sigstore to 1.10.4 or later.
go get github.com/sigstore/sigstore@v1.10.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.10.4 | - |
Fixed versions
| 1.10.4 |
Sources
- osv: GO-2026-4358
- https://github.com/sigstore/sigstore/security/advisories/GHSA-fcv2-xgw5-pqxf
- https://github.com/sigstore/sigstore/commit/8ec410a2993ea78083aecf0e473a85453039496e
- https://github.com/sigstore/sigstore/releases/tag/v1.10.4
CVE-2026-24137 · published · modified · JSON