CVE-2026-128035

The gittuf tool versions 0.10.0 through 0.17.0 contains a vulnerability where the verification workflow fails to load policy updates propagated from an upstream controller repository after the first entry is verified. Because only the policy in effect at the start of verification is applied, subs...