CVE-2026-49834

sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.0, a verifier configured with WithTransparencyLog(N>1) or WithSignedCertificateTimestamps(N>1) counts verified witnesses per entry or per validation path rather than per log authority, allowing a single compromised transparency log or CT log to satisfy multi-log threshold requirements and defeat the multi-log policy. This issue is fixed in version 1.2.0.

• CWE-347

• https://github.com/sigstore/sigstore-go/commit/dbb07e62623edd5b175fb9dd5a41dcb85a159207Patch
• https://github.com/sigstore/sigstore-go/pull/633Issue Tracking, Patch
• https://github.com/sigstore/sigstore-go/releases/tag/v1.2.0Product, Release Notes
• https://github.com/sigstore/sigstore-go/security/advisories/GHSA-9vcr-p3rj-q5q6Vendor Advisory

Published

Jul 17, 2026

Last Modified

Jul 30, 2026

Status

Analyzed

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4982A user with permission "update world" in any Venueless world…7.3
• CVE-2026-49821Fission is an open-source, Kubernetes-native serverless fram…7.7
• CVE-2026-49822Fission is an open-source, Kubernetes-native serverless fram…7.7
• CVE-2026-49823Fission is an open-source, Kubernetes-native serverless fram…7.7
• CVE-2026-49824Fission is an open-source, Kubernetes-native serverless fram…8.5
• CVE-2026-4983Open VSX Registry does not sanitize SVG files uploaded as ex…5.4
• CVE-2026-49835Sigstore Timestamp Authority is a service for issuing RFC 31…7.5
• CVE-2026-49839jq is a command-line JSON processor. Prior to 1.8.2,` jq --r…7.1
• CVE-2026-4984The Twilio integration webhook handler accepts any POST requ…8.2
• CVE-2026-49840FreeSWITCH is a Software Defined Telecom Stack enabling the …9.1
• CVE-2026-49841FreeSWITCH is a Software Defined Telecom Stack enabling the …9.8
• CVE-2026-49842FreeSWITCH is a Software Defined Telecom Stack enabling the …7.5