rekor

Rekor Rekór - Greek for “Record” Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain. Rekor will enable software maintainers and build systems to record signed metadata to an immutable record. Other parties can then query...

cve-2026-59891-control-lab

CVE-2026-59891 Regression & Control Lab An isolated hands-on lab and read-only audit project that compares the actual vulnerable and fixed versions of @sigstore/oci with the same input and checks environment-specific exposure conditions. The CVE Reporter for this project is gyubin02...

root-signing

Sigstore root-signing root-signing project maintains the TUF repository used to securely deliver the Sigstore trust root trustedroot.json to Sigstore clients. Documentation signer manual documents the process and requirements from keyholder perspective maintainer manual documents some maintenance...

text4shell-policy

Text4Shell Demo This demo shows how you can use Sigstore to validate your signed SBOMs against text4shell policies in Kubernetes or on the command line Option 1: Check if your remote OCI image is affected using cue with cosign 2.0 cosign verify-attestation --policy policy/text4shell.cue --type...

GO-2026-6880 vulnerabilities

Vulnerabilities for packages: tekton-pipelines, sigstore-scaffolding, traefik, kserve...

GO-2026-6880 vulnerabilities

Vulnerabilities for packages: kserve-localmodelnode-agent-fips, kserve-localmodelnode-agent, tekton-pipelines, tekton-pipelines-fips, kserve-fips, sigstore-scaffolding, kserve, traefik-fips, traefik, sigstore-scaffolding-fips...

CVE-2026-118763

A flaw was found in @sigstore/oci. This vulnerability allows a malicious or compromised container registry to cause an information disclosure of sensitive authentication credentials. When pushing an artifact, the client sends an upload request to a registry-provided destination address without...

Critical: Red Hat Security Advisory: RHTAS 1.5.1 - Tech Preview Release Of the Sigstore A2A 0.0.2

The Tech Preview release of the Sigstore A2A image 0.0.2. For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/redhattrustedartifactsigner/1.5 The Sigstore A2A image can be used to sign and verify AI/ML workloads...

Sigstore Cosign Bypass Security Restrictions

The vulnerability in the cosign verify-blob and cosign verify-blob-attestation commands of the Sigstore Cosign digital signature tool is related to errors in the certificate verification process, allowing a remote attacker to bypass security restrictions...

CLEANSTART-2026-KN02152 sigstore-go is a Go library for Sigstore signing and verification

CVE-2026-49834 affects multiple packages. sigstore-go is a Go library for Sigstore signing and verification. See references for individual vulnerability details...

CLEANSTART-2026-IQ57265 sigstore-go is a Go library for Sigstore signing and verification

Security vulnerability affects the cosign-fips package. sigstore-go is a Go library for Sigstore signing and verification...

CLEANSTART-2026-JP58072 Cosign provides container signing, verification, and storage in an OCI registry for the sigstore project

Security vulnerability affects the cosign-fips package. Cosign provides container signing, verification, and storage in an OCI registry for the sigstore project...

CLEANSTART-2026-EV96739 Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure

Security vulnerability affects the cosign-fips package. Cosign is a project under the sigstore organization which aims to make signatures invisible infrastructure...

CLEANSTART-2026-FQ22177 sigstore-js provides JavaScript libraries for interacting with Sigstore services

Security vulnerability affects the npm package. sigstore-js provides JavaScript libraries for interacting with Sigstore services...

CLEANSTART-2026-HD09461 sigstore-js provides JavaScript libraries for interacting with Sigstore services

Security vulnerability affects the npm package. sigstore-js provides JavaScript libraries for interacting with Sigstore services...

CLEANSTART-2026-II84819 sigstore-js provides JavaScript libraries for interacting with Sigstore services

Security vulnerability affects the npm package. sigstore-js provides JavaScript libraries for interacting with Sigstore services...

EUVD-2026-113272

@sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location...

@sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location

Summary @sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location Affected versions and vulnerable location - Confirmed on sigstore-js at 3a83271 current HEAD. - File: packages/oci/src/registry.ts. - signIn installs the credential as a DEFAULT header on the shared...

@sigstore/cli (>=0.7.0, <=0.9.1) potentially affected by CVE-2026-118763 via @sigstore/oci (>=0.2.0, <=0.6.1)

@sigstore/oci NPM version =0.2.0, =0.7.0, =0.9.1 Source cves: CVE-2026-118763 Source advisory: GHSA-J63V-MWHM-56JX...

@sigstore/cli (>=0.7.0, <=0.9.1) potentially affected by CVE-2026-118763 via @sigstore/oci (>=0.2.0, <=0.6.1)

@sigstore/oci NPM version =0.2.0, =0.7.0, =0.9.1 Source cves: CVE-2026-118763 Source advisory: OSV:GHSA-J63V-MWHM-56JX...