Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Sigstore Timestamp Authority (github.com/sigstore/timestamp-authority/v2) versions before 2.0.6 are affected by improper certificate validation in its verification package. An attacker who can supply a timestamp response can prepend a forged certificate to the certificate bag while signing with an authorized key, which can bypass some authorization checks. Users should upgrade to version 2.0.6. Callers of VerifyTimestampResponse can instead pass the TSACertificate option to pin the expected certificate. The timestamp service itself is not affected.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 5.5 | Medium | 3.1 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N | CNA (GitHub_M) |
- CISA KEV Not listed.
- EPSS 0.0010, the 1st percentile, on 12 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 14:14 UTC First seen by agentprime
- 31 Oct 2026, 14:14 UTC Confirmed by OSV