CVE-2026-39984 sigstore CVE debrief

Who should care

Defenders responsible for Sigstore Timestamp Authority deployments should assess exposure and prioritize verification and remediation efforts. This includes reviewing current certificate chain validation processes, implementing additional monitoring and logging for suspicious activity, and verifying and upgrading to version 2.0.6 or later. Security teams and operators managing affected systems should also review and adjust their current certificate chain  

Why it matters

CVE-2026-39984 is a medium-severity vulnerability affecting Sigstore Timestamp Authority, allowing an attacker to bypass authorization checks by manipulating the certificate chain. Defenders responsible for Sigstore Timestamp Authority deployments should assess exposure and prioritize verification and remediation efforts.

• Potential unauthorized access to timestamped data
• Need to verify and upgrade to version 2.0.6 or later
• Possible manipulation of certificate chains
• Review and adjustment of current certificate validation processes required

Technical summary

The vulnerability affects Sigstore Timestamp Authority versions 2.0.5 and below. The VerifyTimestampResponse function incorrectly uses the first non-CA certificate from the PKCS#7 certificate bag instead of the leaf certificate from the verified chain, allowing an attacker to bypass authorization checks. This issue is caused by the TSA-specific constraint checks in VerifyLeafCert using the first non-CA certificate from the PKCS#7 certificate bag instead of the leaf certificate from the verified chain. The vulnerability only affects users of the timestamp-authority/v2/pkg/verification package.

Defensive priority

Defenders should prioritize verifying and upgrading to version 2.0.6 or later, and review their current certificate chain validation processes.

Recommended defensive actions

• Verify and upgrade to version 2.0.6 or later
• Review current certificate chain validation processes
• Implement additional monitoring and logging for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is caused by the VerifyTimestampResponse function using the first non-CA certificate from the PKCS#7 certificate bag instead of the leaf certificate from the verified chain. This allows an attacker to prepend a forged certificate to the certificate bag while the message is signed with an authorized key.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.