{"action":"Upgrade github.com/sigstore/cosign to 3.0.5 or later.","affected":[{"fixed":"3.0.5","introduced":"0"}],"component":"github.com/sigstore/cosign","cve_ids":["CVE-2026-24122"],"ecosystem":"Go","epss":0.00215,"exploited":false,"fixed_versions":["3.0.5"],"ghsa_id":"GHSA-wfqv-66vq-46rm","id":"tcs_01M5KFQNPHFN192D2Q4MGHRSKC","modified_at":"2026-09-10T03:50:36.127642021Z","published_at":"2026-02-19T22:09:12Z","references":["https://osv.dev/vulnerability/GHSA-wfqv-66vq-46rm","https://github.com/sigstore/cosign/security/advisories/GHSA-wfqv-66vq-46rm","https://nvd.nist.gov/vuln/detail/CVE-2026-24122","https://github.com/sigstore/cosign/commit/3c9a7363f563db76d78e2de2cabd945450f3781e","https://github.com/sigstore/cosign","https://github.com/sigstore/cosign/releases/tag/v3.0.5"],"severity":{"label":"low","score":3.7},"sources":[{"source":"osv","source_id":"GHSA-wfqv-66vq-46rm","url":"https://osv.dev/vulnerability/GHSA-wfqv-66vq-46rm"}],"summary":"Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped"}