CVE-2026-31830
Sigstore ≤ 0.2.3
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-31830 is a high-severity Unchecked Return Value (CWE-252) vulnerability in Sigstore Sigstore. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 12th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-31830 affects sigstore-ruby, a pure Ruby implementation of the sigstore/cosign project's verify command, in versions prior to 0.2.3. The vulnerability lies in the Sigstore::Verifier#verify method, which fails to propagate the VerificationFailure exception returned by verify_in_toto when the artifact digest does not match the digest specified in the in-toto attestation subject. Consequently, verification of DSSE bundles containing in-toto statements always returns VerificationSuccess, even if the artifact does not match the attested subject. This issue is rated 7.5 on the CVSS 3.1 scale (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) and maps to CWE-252 (Unchecked Return Value).
Attackers can exploit this vulnerability remotely with low complexity and no privileges or user interaction required. By supplying a malicious DSSE bundle with an in-toto statement that references a mismatched artifact digest—such as for a tampered binary or package—the verifier will incorrectly deem it authentic. This enables integrity bypass, allowing adversaries to substitute malicious artifacts while evading sigstore's verification checks, potentially leading to deployment of untrusted software in supply chain pipelines.
The GitHub Security Advisory (GHSA-mhg6-2q2v-9h2c) confirms the issue is fixed in sigstore-ruby version 0.2.3, where the verifier now properly propagates the VerificationFailure. Security practitioners should upgrade to 0.2.3 or later and audit usages of Sigstore::Verifier#verify with in-toto attestations, especially in CI/CD workflows relying on sigstore for artifact verification.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-10932
Vulnerability Data
sigstore-ruby is a pure Ruby implementation of the sigstore verify command from the sigstore/cosign project. Prior to 0.2.3, Sigstore::Verifier#verify does not propagate the VerificationFailure returned by verify_in_toto when the artifact digest does not match the digest in the in-toto attestation…
more
subject. As a result, verification of DSSE bundles containing in-toto statements returns VerificationSuccess regardless of whether the artifact matches the attested subject. This vulnerability is fixed in 0.2.3.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and code evaluation can discover instances where return values are ignored.
Requiring a documented development process and coding standards can mandate explicit checking of all function return values.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require checking and handling all function return values to detect error conditions.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development and acceptance can detect missing return-value checks.
Secure development life cycle mandates verification of return values to prevent undetected failures.
Application security requirements include input/output validation and error handling that covers return-value checks.
Secure system architecture and engineering principles require robust error handling and defensive coding practices.
Secure coding explicitly requires checking return values to avoid CWE-252.