CVE-2026-128036

The gittuf tool versions 0.4.0 through 0.16.0 is vulnerable to a flaw where verification checks only validate the root of trust signatures for new policies, failing to verify signatures for other metadata such as rule files . An attacker with push privileges can bypass the gittuf policy apply wor...