CVE-2026-48791

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-48791
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48791.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-48791
Aliases
Downstream
Published
2026-08-12T23:42:23.573Z
Modified
2026-08-15T11:31:10.934613602Z
Severity
  • 2.0 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N CVSS Calculator
Summary
Sigstore Java has a vulnerability with bundle verification of integratedTime
Details

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated (Rekor entry) time) against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verification spec. The old sigstore-conformance test for this check was built incorrectly. This vulnerability impacts only users verifying bundles with dev.sigstore:sigstore-java:2.0.0. Older versions are not affected; it is fixed in dev.sigstore:sigstore-java:2.1.0 A malicious actor may exploit this if they were able to access a users system and exfiltrate the temporary private key used during signing and then reuse an old fulcio certificate later without requiring direct access to the user's credentials. Users may protect themselves by re-verifying their artifacts using the newest sigstore-java or another current sigstore client. Transparency logs may also be audited for unauthorized signatures for a suspected reused identity.

Database specific 
{
    "cwe_ids": [
        "CWE-347"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48791.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/sigstore/sigstore-java

Affected ranges

Type
GIT
Repo
https://github.com/sigstore/sigstore-java
Events
Introduced
411721f4879abebd95bd9ab6ed3724366b13cdce
Fixed
4b7a49ebb1813f5b1ff113bcad63246358222d61
Fixed
b529335728fc5cfb574161b4b3c06859a8a2aa88
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "= 2.0.0"
        },
        {
            "last_affected": "= 2.0.0"
        }
    ]
}

Affected versions

= 2.*
= 2.0.0
v2.*
v2.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48791.json"