Homepage

Improper Verification of Cryptographic Signature Affecting cosign package, versions <3.0.4-r3

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.01% (1st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-MINIMOSLATEST-COSIGN-15170552
  • published2 Feb 2026
  • disclosed22 Jan 2026
Report a new vulnerability Found a mistake?

Introduced: 22 Jan 2026

NewCVE-2026-23992  (opens in a new tab)
CWE-347  (opens in a new tab)

How to fix?

Upgrade Minimos:latest cosign to version 3.0.4-r3 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream cosign package and not the cosign package as distributed by Minimos. See How to fix? for Minimos:latest relevant fixed versions and status.

go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, a compromised or misconfigured TUF repository can have the configured value of signature thresholds set to 0, which effectively disables signature verification. This can lead to unauthorized modification to TUF metadata files is possible at rest, or during transit as no integrity checks are made. Version 2.3.1 fixes the issue. As a workaround, always make sure that the TUF metadata roles are configured with a threshold of at least 1.