CVE-2026-48815
Description
A flaw was found in sigstore. The certificateOIDs option, intended to restrict which certificates can sign artifacts, is accepted by the public application programming interface (API) but is not used during the verification process. This allows unauthorized certificates to be accepted, bypassing security policies that rely on specific certificate extension object identifiers (OIDs). As a result, applications that depend on this option for security receive no protection, potentially leading to the acceptance of malicious or untrusted artifacts.
Statement
A flaw was found in the sigstore npm package. The certificateOIDs verification option is accepted by the API but silently discarded before verification, meaning required certificate extension OIDs are never enforced.
Any such call on sigstore <= 4.1.0 should be treated as if the certificateOIDs block was never there:
await sigstore.verify(bundle, payload, {
certificateIssuer: "...",
certificateIdentityEmail: "...",
certificateOIDs: {
"1.3.6.1.4.1.57264.1.9": "expected-value",
},
});
In order to be affected by the vulnerability, an application must use the sigstore.verify() function with certificateOIDs option.
Note: The CVSS has been adjusted with AC:H, due to it's low real-world exposure.
Mitigation
Upgrade to sigstore 4.1.1 or later.
The majority of products have sigstore-js as a transitive dependency from the npm v10.9.7 package.
sh-5.1$ npm ls sigstore
npm@10.9.7 /usr/lib/node_modules/npm
+-- @npmcli/arborist@8.0.4
| `-- @npmcli/metavuln-calculator@8.0.1
| `-- pacote@20.0.1
| `-- sigstore@3.1.0 deduped
+-- libnpmpublish@10.0.2
| `-- sigstore@3.1.0
`-- pacote@19.0.2
`-- sigstore@3.1.0 deduped
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.9 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | High | N/A | High |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Red Hat CVSS v3 Score Explanation
AC:L→H: certificateOIDs is a rarely-used verification option; exploitation requires victims to explicitly configure OID constraints, an uncommon pattern.
Understanding the Weakness (CWE)
Integrity,Other
Technical Impact: Varies by Context; Unexpected State
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
