CVE-2026-39395CWE-754

Cosign's verify-blob-attestation reports false positive when payload parsing fails

Medium · published April 7, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
20.7
In the wild
Unconfirmed
What it is

Cosign provides code signing and transparency for containers and binaries. Prior to 3.0.6 and 2.6.3, cosign verify-blob-attestation may erroneously report a "Verified OK" result for attestations with malformed payloads or mismatched predicate types. For old-format bundles and detached signatures, this was due to a logic flaw in the error handling of the predicate type validation. For new-format bundles, the predicate type validation was bypassed completely. This vulnerability is fixed in 3.0.6 and 2.6.3.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00293 · 20.7th percentile
Weakness
CWE-754 · Improper Check for Unusual or Exceptional Conditions
Published
2026-04-07T20:06Z
EPSS history
Timeline
  • 07 APR 20:06Z
    Cosign's verify-blob-attestation reports false positive when payload parsing fails
    cvelistv5