Skip to main content
Version: v1.1.x

CVE-2026-39395

CVE Details

Visit the official vulnerability details page for CVE-2026-39395 to learn more.

Initial Publication

04/07/2026

Last Update

04/07/2026

Third Party Dependency

github.com/sigstore/cosign/v2

NIST CVE Summary

Cosign provides code signing and transparency for containers and binaries. Prior to 3.0.6 and 2.6.3, cosign verify-blob-attestation may erroneously report a "Verified OK" result for attestations with malformed payloads or mismatched predicate types. For old-format bundles and detached signatures, this was due to a logic flaw in the error handling of the predicate type validation. For new-format bundles, the predicate type validation was bypassed completely. This vulnerability is fixed in 3.0.6 and 2.6.3.

CVE Severity

4.3

Our Official Summary

Investigation is ongoing to determine how this vulnerability affects our products.

Status

Received

Affected Products & Versions

VersionPaletteAIPaletteAI VerteX
1.1.6⚠️ Impacted⚠️ Impacted
1.0.7⚠️ Impacted⚠️ Impacted

Revision History

No revisions available.