Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-01T19:58:28 sigstore: Sigstore: Unauthorized certificates accepted due to ignored `certificateOIDs` verification option 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CWE-345

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in sigstore.verify() is accepted by the public API but discarded before verification, so required certificate extension OIDs are never checked and applications relying on certificateOIDs to restrict which certificates may sign artifacts can accept unauthorized certificates. This issue is fixed in version 4.1.1.

A flaw was found in sigstore. The `certificateOIDs` option, intended to restrict which certificates can sign artifacts, is accepted by the public application programming interface (API) but is not used during the verification process. This allows unauthorized certificates to be accepted, bypassing security policies that rely on specific certificate extension object identifiers (OIDs). As a result, applications that depend on this option for security receive no protection, potentially leading to the acceptance of malicious or untrusted artifacts.

A flaw was found in the sigstore npm package. The certificateOIDs verification option is accepted by the API but silently discarded before verification, meaning required certificate extension OIDs are never enforced. Upgrade to sigstore 4.1.1 or later. Exploit Intelligence Fix deferred sigstore Red Hat Connectivity Link 1 Fix deferred sigstore Red Hat Enterprise Linux 10 Fix deferred sigstore Red Hat Enterprise Linux 8 Fix deferred sigstore Red Hat Enterprise Linux 9 Fix deferred sigstore Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred sigstore Red Hat OpenShift Dev Spaces Fix deferred sigstore Red Hat Satellite 6 Fix deferred sigstore Self-service automation portal 2 Fix deferred sigstore https://www.cve.org/CVERecord?id=CVE-2026-48815 https://nvd.nist.gov/vuln/detail/CVE-2026-48815 https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr