Skip to content
Fencer Vulns
medium 5.5

CVE-2026-39984 json

Sigstore Timestamp Authority has Improper Certificate Validation in verifier

published 2026-04-14 6 mo ago modified 2026-10-26 13 d ago also EUVD-2026-22813 , GHSA-xm5m-wgh2-rrg3 , GO-2026-5763

cvss
5.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.1%
EPSS 0.1% chance of exploitation in 30 days, percentile 0%
public exploits
0
none known

Summary

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Versions 2.0.5 and below contain an authorization bypass vulnerability in the VerifyTimestampResponse function. VerifyTimestampResponse correctly verifies the certificate chain signature, but the TSA-specific constraint checks in VerifyLeafCert uses the first non-CA certificate from the PKCS#7 certificate bag instead of the leaf certificate from the verified chain. An attacker can exploit this by prepending a forged certificate to the certificate bag while the message is signed with an authorized key, causing the library to validate the signature against one certificate but perform authorization checks against another. This vulnerability only affects users of the timestamp-authority/v2/pkg/verification package and does not affect the timestamp-authority service itself or sigstore-go. The issue has been fixed in version 2.0.6.

Patch / fix

  • go github.com/sigstore/timestamp-authority/v2 2.0.6
  • linuxfoundation sigstore_timestamp_authority 2.0.6
  • golang-github-sigstore-timestamp-authority Debian 14 2.1.0-1

debian advisories DEBIAN-CVE-2026-39984

  • docker Linux Micro 6.2 29.7.2_ce-160000.8.1
  • docker Linux Micro 6.1 29.7.2_ce-slfo.1.1_11.1
  • docker Linux Micro 6.0 29.7.2_ce-159998.1.1
  • docker Linux Micro 6.0 29.4.0_ce-11.1
  • docker Linux Micro 6.1 29.4.0_ce-slfo.1.1_10.1
  • docker SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +12 more 29.4.0_ce-150000.253.1
  • docker SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 29.4.0_ce-160000.7.1

suse advisories SUSE-SU-2026:24410-1SUSE-SU-2026:24279-1SUSE-SU-2026:24318-1SUSE-SU-2026:22513-1SUSE-SU-2026:22456-1SUSE-SU-2026:2692-1

  • docker openSUSE Leap 16.0 29.7.2_ce-160000.8.1
  • govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
  • docker openSUSE Tumbleweed 29.4.0_ce-40.1
  • docker openSUSE Leap 16.0 29.4.0_ce-160000.7.1
  • hauler openSUSE Tumbleweed 1.4.3-1.1
  • trivy openSUSE Tumbleweed 0.70.0-1.1

opensuse advisories openSUSE-SU-2026:22158-1openSUSE-SU-2026:21483-1openSUSE-SU-2026:11144-1openSUSE-SU-2026:21060-1openSUSE-SU-2026:10702-1openSUSE-SU-2026:10651-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-39984 updated cvss 5.5

timestamp-authority/v2/pkg/verification: improper certificate validation in verifier

  • Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-roxctl-rhel8, advanced-cluster-security/rhacs-rhel8-operator, advanced-cluster-security/rhacs-scanner-v4-rhel8 Red Hat Trusted Artifact Signer rhtas/ec-rhel9, rhtas/cosign-rhel9, rhtas/gitsign-rhel9 Red Hat Security Profiles Operator compliance/openshift-security-profiles-rhel8-operator, compliance/openshift-security-profiles-operator-bundle
    affected: workaround, no fix available “To mitigate this vulnerability, users of VerifyTimestampResponse can use the TSACertificate option to explicitly specify the exact certificate they expect to be used.”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
6 mo ago

Exploit prediction

0.10% chance of exploitation in the next 30 days, higher than 0% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
GitHub 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Affected packages

ecosystem package affected fixed in
go github.com/sigstore/timestamp-authority/v2
<2.0.6
2.0.6
go github.com/sigstore/timestamp-authority
all versions
 no fix listed

Affected products

  • sigstore timestamp-authority

Classification

Weakness
  • CWE-295 Improper Certificate Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.