THREATOPS
THREAT OPS › Threat News › [GHSA] GHSA-wqqc-jjcq-vfxm (low) — sigstore-go fails to check signature timestamps against a signing key's validity period

[GHSA] GHSA-wqqc-jjcq-vfxm (low) — sigstore-go fails to check signature timestamps against a signing key's validity period

highgithub_advisoriesPublished 2026-07-31

GHSA-wqqc-jjcq-vfxm Severity: low CVE: CVE-2026-54787

sigstore-go fails to check signature timestamps against a signing key's validity period

sigstore-go fails to check signature timestamps against a signing key's validity period for self-managed long-lived keys without certificates.

## Impact

To verify a bundle with a self-managed long-lived key, the key needs to be wrapped in an `ExpiringKey

Indicators of compromise

Original source: https://github.com/advisories/GHSA-wqqc-jjcq-vfxm