CVE-2026-24122: 
Datadog Agent vulnerability analysis and mitigation

CVE-2026-24122 is an improper certificate validation vulnerability in Sigstore Cosign, a tool for code signing and transparency for containers and binaries. When verifying artifact signatures, Cosign incorrectly assumes that all issuing (intermediate and root) CA certificates remain valid throughout the leaf certificate's validity period, without checking whether those CA certificates have actually expired at the time of the provided timestamp. This flaw affects Cosign versions 3.0.4 and below; version 3.0.5 contains the fix. It carries a CVSS v3.1 base score of 3.7 (Low) (GitHub Advisory, Cosign Security Advisory).

The root cause is classified as CWE-295 (Improper Certificate Validation). During signature verification, Cosign's CheckExpiry function previously validated only the leaf certificate's validity window against the provided timestamp (from Rekor, a timestamp authority, or the current time), while the chain verification used the leaf certificate's NotBefore timestamp — implicitly assuming all issuing CAs were valid during the leaf's lifetime. This means a leaf certificate issued with a NotAfter timestamp beyond the expiry of an intermediate or root CA would still pass verification, even if the signing timestamp falls after the CA's expiry. The fix, introduced in commit 3c9a736, modifies CheckExpiry to iterate over the entire issuing chain and validate each CA certificate's validity window against the provided timestamp (Cosign Commit, Cosign Security Advisory).

The primary impact is a low-integrity bypass: an artifact signed with a certificate whose issuing CA has expired could be incorrectly accepted as valid by Cosign, undermining the trust guarantees of the signing chain. There is no confidentiality or availability impact. Critically, this issue has no impact on users of the public Sigstore infrastructure; it only affects private deployments using customized PKIs where a CA may issue leaf certificates that outlive the CA's own validity period — a configuration that is atypical in well-managed PKIs (GitHub Advisory).

No public exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.015% (1st percentile), indicating a very low probability of exploitation in the near term (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high attack complexity, as it depends on a non-standard PKI configuration where a CA issues certificates that outlive the CA itself — a scenario the advisory notes is unlikely in practice.

1. Identify a vulnerable private PKI deployment: Locate an environment using Cosign ≤ 3.0.4 with a custom PKI where an intermediate or root CA certificate has a shorter validity period than leaf certificates it has issued.
2. Obtain or craft a leaf certificate: Acquire a leaf certificate whose NotAfter timestamp extends beyond the NotAfter of an issuing CA certificate in the chain.
3. Generate a signed artifact: Sign a container image or binary using the leaf certificate, producing a signature with a timestamp (e.g., via Rekor or a timestamp authority) that falls after the CA's expiry but within the leaf certificate's validity window.
4. Submit for verification: Present the signed artifact to a Cosign verification workflow. Because Cosign only checks the leaf certificate's validity against the timestamp and uses the leaf's NotBefore for chain validation, the expired intermediate/root CA is not flagged.
5. Bypass integrity check: Verification succeeds despite the CA being expired at the time of signing, allowing a potentially unauthorized or post-CA-expiry signature to be accepted as valid (Cosign Security Advisory, Cosign Commit).

The primary remediation is to upgrade Cosign to version 3.0.5 or later, which enforces validity checks on the entire certificate chain (not just the leaf) against the provided timestamp (Cosign Release v3.0.5). As a workaround for those unable to upgrade immediately, the advisory recommends verifying the certificate chain out-of-band using standard PKI tooling (e.g., openssl verify) to manually confirm all CA certificates in the chain are valid at the time of signing (Cosign Security Advisory). Users of the public Sigstore infrastructure do not need to take any action, as they are unaffected.

The vulnerability was reported by contributor 1seal and published by Hayden-IO of the Sigstore/Cosign maintainer team on February 19, 2026. The advisory was reviewed and patched on the same day, reflecting a rapid response from the Sigstore project. No significant broader media coverage or notable external researcher commentary has been identified beyond the official advisory and standard vulnerability database aggregation (GitHub Advisory).