UNKNOWN Go
sigstore-go fails to check signature timestamps against a signing key's validity period in github.com/sigstore/sigstore-go
GO-2026-6162 · CVE-2026-54787 · GHSA-wqqc-jjcq-vfxm
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
sigstore-go fails to check signature timestamps against a signing key's validity period in github.com/sigstore/sigstore-go
References
Ready to move
Start Securing
Free, no credit card | First findings in minutes