CVE-2026-44309

Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. Prior to 0.16.0, gitsign verify and gitsign verify-tag re-encode commit/tag objects through go-git's EncodeWithoutSignature before checking the signature, instead of verifying against the raw git object bytes. For malformed objects with duplicate tree headers, git-core and go-git parse different trees: git-core uses the first, go-git uses the second. A signature crafted over the go-git-normalized form (second tree) passes gitsign verify while git-core resolves the commit to a completely different tree. This breaks the invariant that a verified signature, the commit semantics git-core presents to users, and the object hash logged in Rekor all refer to the same content. This vulnerability is fixed in 0.16.0.

• CWE-295
• CWE-347

• https://github.com/sigstore/gitsign/security/advisories/GHSA-7rmh-48mx-2vwc
• https://github.com/sigstore/gitsign/security/advisories/GHSA-7rmh-48mx-2vwc

Published

May 15, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44302Snappier is a high performance C# implementation of the Snap…7.5
• CVE-2026-44304Lemur manages TLS certificate creation. Prior to 1.9.0, Lemu…8.1
• CVE-2026-44305Lemur manages TLS certificate creation. Prior to 1.9.0, when…6.8
• CVE-2026-44306Statamic is a Laravel and Git powered content management sys…5.3
• CVE-2026-44307Mako is a template library written in Python. Prior to 1.3.1…8.7
• CVE-2026-44308Spring Cloud AWS simplifies using AWS managed services in a …6.3
• CVE-2026-4431The Easy Post Submission plugin for WordPress is vulnerable …9.1
• CVE-2026-44310Gitsign is a keyless Sigstore to signing tool for Git commit…5.4
• CVE-2026-44311Fabric.js is a Javascript HTML5 canvas library. Prior to 7.4…6.1
• CVE-2026-44312css_parser is a Ruby CSS parser. Prior to 2.1.0 and 1.22.0, …5.8
• CVE-2026-44313Linkwarden is a self-hosted, open-source collaborative bookm…9.1
• CVE-2026-44314Traccar is an open source GPS tracking system. Prior to 6.13…4.3