Bug 2499687 (CVE-2026-48815)

Summary: CVE-2026-48815 sigstore: Sigstore: Unauthorized certificates accepted due to ignored `certificateOIDs` verification option
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: anthomas, bbrownin, dfreiber, drow, dschmidt, eborisov, ehelms, ggainey, gtanzill, jburrell, jbuscemi, jlanda, jpasqual, juwatts, kshier, lball, mdellweg, mhulan, mstipich, ngough, nmoumoul, osousa, pcreech, rchan, rekumar, rexwhite, rhel-process-autobot, sdawley, simaishi, smallamp, stcannon, sthirugn, teagle, tmalecek, veshanka, vkumar, vvoronko, watson-tool-maintainers, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in sigstore. The `certificateOIDs` option, intended to restrict which certificates can sign artifacts, is accepted by the public application programming interface (API) but is not used during the verification process. This allows unauthorized certificates to be accepted, bypassing security policies that rely on specific certificate extension object identifiers (OIDs). As a result, applications that depend on this option for security receive no protection, potentially leading to the acceptance of malicious or untrusted artifacts.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-13 14:40:09 UTC
The documented certificateOIDs option in sigstore.verify() is accepted by the public API but discarded before verification, so required certificate extension OIDs are never checked. Applications that rely on certificateOIDs to restrict which certificates may sign artifacts receive no protection. Unauthorized certificates that should be rejected on extension policy are accepted. Fixed in sigstore 4.1.1.