{"action":"Upgrade github.com/sigstore/cosign/v3 to 3.0.5 or later.","affected":[{"fixed":"3.0.5","introduced":"0"}],"component":"github.com/sigstore/cosign/v3","cve_ids":["CVE-2026-24122"],"ecosystem":"Go","epss":0.00215,"exploited":false,"fixed_versions":["3.0.5"],"ghsa_id":"GHSA-wfqv-66vq-46rm","id":"tcs_01M5KGEBJ2X9HV8DP53K52RHSB","modified_at":"2026-06-16T16:44:28.615704146Z","published_at":"2026-02-23T18:23:15Z","references":["https://osv.dev/vulnerability/GO-2026-4529","https://github.com/sigstore/cosign/security/advisories/GHSA-wfqv-66vq-46rm","https://nvd.nist.gov/vuln/detail/CVE-2026-24122","https://github.com/sigstore/cosign/commit/3c9a7363f563db76d78e2de2cabd945450f3781e","https://github.com/sigstore/cosign/releases/tag/v3.0.5"],"severity":{"label":"low","score":3.7},"sources":[{"source":"osv","source_id":"GO-2026-4529#Go/github.com/sigstore/cosign/v3","url":"https://osv.dev/vulnerability/GO-2026-4529"},{"source":"nvd","source_id":"CVE-2026-24122","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24122"}],"summary":"Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign"}