CVE-2026-128035

In gittuf 0.10.0 through 0.17.0, the verification workflow does not load policy updates that are propagated from an upstream controller repository and recorded in the reference state log after the first entry being verified. Only the propagated policy in effect at the start of verification is...