CVE-2026-31830
High
Description
sigstore-ruby is a pure Ruby implementation of the sigstore verify command from the sigstore/cosign project. Prior to 0.2.3, Sigstore::Verifier#verify does not propagate the VerificationFailure returned by verify_in_toto when the artifact digest does not match the digest in the in-toto attestation subject. As a result, verification of DSSE bundles containing in-toto statements returns VerificationSuccess regardless of whether the artifact matches the attested subject. This vulnerability is fixed in 0.2.3.
SeverityHigh
CVSS7.5
Exploit probability—
ProductSigstore
PublishedMar 10, 2026
First seenMar 10, 2026
Weakness typeCWE-252CWE-252
How to fix
Update
- sigstore sigstore0.2.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sigstore sigstore | v < 0.2.3 | 0.2.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.