What’s Vulnerable › Products

sigstore gitsign vulnerabilities

4 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 3 published in the last 12 months.

Check whether your sigstore gitsign version is affected

Latest sigstore gitsign vulnerabilities

• CVE-2026-44310 — gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers (CVSS 5.4)
• CVE-2026-44309 — gitsign verify accepts signatures over go-git-normalized bytes, enabling trust confusion on malformed commits (CVSS 5.3)
• CVE-2024-51746 — Use of incorrect Rekor entries during verification in gitsign (CVSS 1.8)
• CVE-2023-47122 — Gitsign's Rekor public keys fetched from upstream API instead of local TUF client. (CVSS 5.3)