Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
3.7

Tekton‑Chains may accept forged code signatures

published 5 days ago
Summary

The Tekton‑Chains component that uses Cosign to verify the authenticity of container images can be fooled into trusting a fake signature. This could let attackers introduce malicious code that appears legitimate. Update Tekton‑Chains to the latest version or apply the vendor’s recommended patch to restore proper signature verification.

What to do
  • Update cleanstart tekton-chains to version 0.29.7-r1.
Affected software
Ecosystem VendorProductAffected versions
CleanStart cleanstart tekton-chains < 0.29.7-r1
Fix: upgrade to 0.29.7-r1
Original advisory text
Cosign provides code signing and transparency for containers and binaries
Security vulnerability affects the tekton-chains package. Cosign provides code signing and transparency for containers and binaries.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
3.7 Low
Timeline
Published30 Oct 2026
Updated31 Oct 2026
First seen31 Oct 2026
Sources
CLEANSTART-2026-VF18758 · OSV
Track software like this
Free during beta