CVE-2026-48791: 
Java vulnerability analysis and mitigation

CVE-2026-48791 is a cryptographic signature verification bypass vulnerability in sigstore-java (Maven package dev.sigstore:sigstore-java) affecting exclusively version 2.0.0. The flaw is a regression introduced by PR #1008, which erroneously removed the check that validates the Rekor V1 Log Entry integratedTime against the Fulcio certificate's validity period, allowing bundles with out-of-range timestamps to pass verification unexpectedly. It was first published on May 26, 2026, and added to the GitHub Advisory Database on June 30, 2026. The CVSS v3.1 base score is 2.0 (Low) (Github Advisory).

The root cause is classified as CWE-347 (Improper Verification of Cryptographic Signature). PR #1008, which added Rekor v2 support to KeylessSigner and KeylessVerifier, inadvertently removed the call that cross-checks the Rekor entry's integratedTime against the Fulcio signing certificate's notBefore/notAfter validity window in KeylessVerifier.verifyTimestamps(). As a result, a bundle containing a Rekor entry whose integratedTime falls outside the certificate's validity period — for example, a future timestamp — would pass verification without error. The fix in PR #1185 re-introduced this check by extracting integratedTimeInstant from the verified Signed Entry Timestamp (SET) and calling leafCert.checkValidity(entryDate), throwing KeylessVerificationException on mismatch (Github Advisory, PR #1185).

Successful exploitation allows a malicious actor to present a Sigstore bundle signed with a reused or expired Fulcio certificate — one whose validity period does not encompass the claimed signing time — and have it accepted as valid by applications using sigstore-java:2.0.0. The practical attack scenario requires the adversary to have previously exfiltrated the ephemeral private key used during signing and to possess an old Fulcio certificate, enabling them to forge artifact signatures without needing the victim's current credentials. The integrity impact is limited (low) and there is no confidentiality or availability impact; however, in software supply chain contexts, accepting a forged signature could lead to deployment of tampered artifacts (Github Advisory).

No public exploit kit or weaponized tooling has been reported. A proof-of-concept bundle (bundle.sigstore.json with a future integratedTime) was added to the sigstore-conformance test suite and demonstrates that sigstore-java:2.0.0 incorrectly passes verification for such a bundle. Exploitation requires high privileges (access to the victim's system to exfiltrate the ephemeral private key) and user interaction, making opportunistic exploitation unlikely. The CVE status remains "Reserved" and there is no evidence of in-the-wild exploitation or CISA KEV catalog listing (Github Advisory).

1. Obtain a prior Fulcio certificate: The attacker must have previously exfiltrated the ephemeral private key and corresponding Fulcio certificate from a target's signing environment (e.g., via prior system compromise).
2. Craft a malicious bundle: Construct a Sigstore bundle (bundle.sigstore.json) that includes a Rekor V1 log entry with an integratedTime value outside the Fulcio certificate's validity window (e.g., set to a future Unix timestamp).
3. Submit the bundle for verification: Present the crafted bundle to a system or CI/CD pipeline that uses dev.sigstore:sigstore-java:2.0.0 for artifact verification (e.g., via sigstore-cli verify --bundle=bundle.sigstore.json <artifact>).
4. Bypass verification: Because version 2.0.0 does not check integratedTime against the certificate validity, the verification succeeds without error, allowing the forged signature to be accepted as legitimate.
5. Achieve objective: The attacker's tampered artifact is treated as trusted, potentially enabling deployment of malicious code in supply chain workflows (Github Advisory, PR #1185).

• Logs: Sigstore verification logs showing successful bundle verification for artifacts where the Rekor integratedTime falls outside the Fulcio certificate's notBefore/notAfter window; absence of KeylessVerificationException messages such as "Signing time was before certificate validity" or "Signing time was after certificate expiry" when such conditions exist.
• File System: Presence of bundle.sigstore.json files containing tlogEntries with integratedTime values that do not align with the associated certificate's validity period.
• Transparency Log: Audit of the Rekor transparency log for entries associated with a known identity (e.g., a service account email in the Fulcio certificate SAN) that were submitted at unexpected times or using certificates that had already expired (Github Advisory).

Upgrade to dev.sigstore:sigstore-java:2.1.0, which re-introduces and enhances integratedTime verification against the Fulcio certificate validity period (PR #1185, commit b529335). Only version 2.0.0 is affected; older versions are not vulnerable. As an interim measure, users can re-verify artifacts using another current Sigstore client (e.g., cosign) and audit the Rekor transparency log for unauthorized signatures associated with any suspected reused identity (Github Advisory).