CVE-2026-49834: 
Docker Compose vulnerability analysis and mitigation

CVE-2026-49834 is a multi-log threshold bypass vulnerability in the sigstore-go Go library (github.com/sigstore/sigstore-go) that allows a single compromised transparency log or CT log to fully satisfy multi-log threshold verification requirements. It affects all versions up to and including v1.1.4. The vulnerability was originally published on June 4, 2026 by Hayden-IO and added to the GitHub Advisory Database on July 9, 2026. It carries a CVSS v3.1 base score of 5.9 (Medium) (GitHub Advisory, Sigstore Advisory).

The root cause is classified as CWE-345 (Insufficient Verification of Data Authenticity). When a verifier is configured with WithTransparencyLog(N>1) or WithSignedCertificateTimestamps(N>1), the intent is to require corroboration from multiple independent log authorities as a defense-in-depth measure. However, the threshold counting logic counted verified witnesses per-entry or per-validation-path rather than per-log-authority (i.e., per unique log identity). This flaw means a single compromised Rekor transparency log can forge multiple entries with different indices to count as multiple distinct witnesses, and a single compromised CT log can verify multiple times via multiple certificate chains or multiple embedded SCTs — collectively satisfying the N-log threshold without involving any additional log authority. Cosign is not affected because it sets a threshold of 1, making the multi-log counting logic irrelevant (GitHub Advisory, Sigstore Advisory).

Successful exploitation undermines the integrity guarantees of software supply chain verification workflows that rely on sigstore-go with multi-log thresholds greater than 1. An attacker who controls or compromises a single transparency log or CT log can forge artifact signatures or certificate validations that appear to satisfy a multi-log policy, enabling the acceptance of tampered or malicious software artifacts as legitimately signed. There is no confidentiality or availability impact; the risk is entirely to integrity — specifically, the trustworthiness of the software signing and verification pipeline (GitHub Advisory).

Users should upgrade github.com/sigstore/sigstore-go to v1.2.0 (patched version), which corrects the threshold counting logic to count per-log-authority rather than per-entry or per-validation-path. The advisory also references v1.1.5 as a patched target; users should confirm the latest available patched release. There is no configuration-based workaround available — the only alternative mitigation is to rely exclusively on trusted, uncompromised logs, which does not address the underlying flaw (GitHub Advisory, Sigstore Advisory).