CVE-2026-48791

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated (Rekor entry) time) against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verification spec. The old sigstore-conformance test for this check was built incorrectly. This vulnerability impacts only users verifying bundles with `dev.sigstore:sigstore-java:2.0.0`. Older versions are not affected; it is fixed in `dev.sigstore:sigstore-java:2.1.0` A malicious actor may exploit this if they were able to access a users system and exfiltrate the temporary private key used during signing and then reuse an old fulcio certificate later without requiring direct access to the user's credentials. Users may protect themselves by re-verifying their artifacts using the newest sigstore-java or another current sigstore client. Transparency logs may also be audited for unauthorized signatures for a suspected reused identity.

• CWE-347

• https://github.com/sigstore/sigstore-java/commit/4b7a49ebb1813f5b1ff113bcad63246358222d61
• https://github.com/sigstore/sigstore-java/commit/b529335728fc5cfb574161b4b3c06859a8a2aa88
• https://github.com/sigstore/sigstore-java/pull/1008
• https://github.com/sigstore/sigstore-java/pull/1185
• https://github.com/sigstore/sigstore-java/security/advisories/GHSA-qqw8-7c2r-jxch
• https://github.com/sigstore/sigstore-java/security/advisories/GHSA-qqw8-7c2r-jxch

Published

Aug 13, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48786Fleet is an open-source device management platform built on …6.5
• CVE-2026-48787gin-vue-admin is an AI-assisted basic development platform. …7.4
• CVE-2026-48788Remark42 is a self-hosted comment engine for blogs, articles…8.2
• CVE-2026-48789AnythingLLM is an application that turns pieces of content i…4.3
• CVE-2026-4879GitLab has remediated an issue in GitLab EE affecting all ve…4.3
• CVE-2026-48790Turso CLI is the command line interface (CLI) to the open-so…5.5
• CVE-2026-48792pam_usb provides hardware authentication for Linux using ord…4.4
• CVE-2026-48793Jellyfin is an open source self hosted media server. Prior t…8.8
• CVE-2026-48794Authelia is an open-source authentication and authorization …1.3
• CVE-2026-48795AdonisJS is a TypeScript-first web framework. From 10.1.3 un…8.6
• CVE-2026-48796CefSharp provides .NET bindings for the Chromium Embedded Fr…5.3
• CVE-2026-48797Backpropagate is a Python library for fine-tuning large lang…9.3