CVE-2026-23831

Rekor is a software supply chain transparency log. In versions 1.4.3 and below, the entry implementation can panic on attacker-controlled input when canonicalizing a proposed entry with an empty spec.message, causing nil Pointer Dereference. Function validate() returns nil (success) when message is empty, leaving sign1Msg uninitialized, and Canonicalize() later dereferences v.sign1Msg.Payload. A malformed proposed entry of the cose/v0.0.1 type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal. This issue has been fixed in version 1.5.0.

• CWE-476

• https://github.com/sigstore/rekor/commit/39bae3d192bce48ef4ef2cbd1788fb5770fee8cdPatch
• https://github.com/sigstore/rekor/releases/tag/v1.5.0Product, Release Notes
• https://github.com/sigstore/rekor/security/advisories/GHSA-273p-m2cw-6833Vendor Advisory

Published

Jan 22, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-23825Vulnerabilities exist in a protocol-handling component of AO…7.5
• CVE-2026-23826A vulnerability in a network management service of AOS-8 Ope…7.5
• CVE-2026-23827A heap-based buffer overflow vulnerability exists in a Netwo…7.5
• CVE-2026-23829Mailpit is an email testing tool and API for developers. Pri…5.3
• CVE-2026-2383The Simple Download Monitor plugin for WordPress is vulnerab…6.4
• CVE-2026-23830SandboxJS is a JavaScript sandboxing library. Versions prior…10
• CVE-2026-23833ESPHome is a system to control microcontrollers remotely thr…7.5
• CVE-2026-23835LobeHub is an open source human-and-AI-agent network. Prior …5.7
• CVE-2026-23836HotCRP is conference review software. A problem introduced i…8.8
• CVE-2026-23837MyTube is a self-hosted downloader and player for several vi…9.8
• CVE-2026-23838Tandoor Recipes is a recipe manager than can be installed wi…8.7
• CVE-2026-23839Movary is a web application to track, rate and explore your …6.1