CVE-2026-39395

Name of the Vulnerable Software and Affected Versions Cosign versions prior to 3.0.6 and prior to 2.6.3

Description Cosign, a tool for code signing and transparency for containers and binaries, had a flaw in verify-blob-attestation where it could incorrectly report a successful verification (“Verified OK”) for attestations containing malformed payloads or mismatched predicate types. This occurred due to a logic error in predicate type validation for older bundle formats and a complete bypass of predicate type validation for newer bundle formats.

Recommendations Update to version 3.0.6 or later. Update to version 2.6.3 or later.