Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
cosign may accept forged software updates
published 5 days ago
Summary
The cosign tool uses the go-tuf library to verify updates. A flaw in this library could let an attacker tamper with the update files and make cosign think they are authentic. Install the latest cosign release that includes the fix or apply the vendor's patch as soon as possible.
What to do
- Update cleanstart cosign to version 2.6.4-r1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | cosign |
< 2.6.4-r1 Fix: upgrade to 2.6.4-r1
|
Original advisory text
go-tuf is a Go implementation of The Update Framework (TUF)
Security vulnerability affects the cosign package. go-tuf is a Go implementation of The Update Framework (TUF).
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published30 Oct 2026
Updated31 Oct 2026
First seen31 Oct 2026
Sources
CLEANSTART-2026-PW57553 · OSV
Track software like this
Free during beta