{ "document": { "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "National Cyber Security Centre", "namespace": "https://www.ncsc.nl/" }, "title": "CVE-2026-24122", "tracking": { "current_release_date": "2026-03-21T20:01:59.428064Z", "generator": { "date": "2026-02-17T15:00:00Z", "engine": { "name": "V.E.L.M.A", "version": "1.7" } }, "id": "CVE-2026-24122", "initial_release_date": "2026-02-19T22:38:57.247724Z", "revision_history": [ { "date": "2026-02-19T22:38:57.247724Z", "number": "1", "summary": "CVE created.| Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products created (1).| References created (3).| CWES updated (1)." }, { "date": "2026-02-19T22:39:06.142481Z", "number": "2", "summary": "NCSC Score created." }, { "date": "2026-02-19T22:39:41.951033Z", "number": "3", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (2).| CWES updated (1)." }, { "date": "2026-02-19T22:39:45.297206Z", "number": "4", "summary": "NCSC Score updated." }, { "date": "2026-02-19T23:25:10.887877Z", "number": "5", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (3).| CWES updated (1)." }, { "date": "2026-02-19T23:25:22.731821Z", "number": "6", "summary": "NCSC Score updated." }, { "date": "2026-02-20T00:12:50.747756Z", "number": "7", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products created (1).| References created (1).| CWES updated (1)." }, { "date": "2026-02-20T07:35:20.676593Z", "number": "8", "summary": "NCSC Score updated." }, { "date": "2026-02-20T14:14:16.163830Z", "number": "9", "summary": "Source created.| CVE status created. (valid)| EPSS created." }, { "date": "2026-02-20T14:14:18.783647Z", "number": "10", "summary": "NCSC Score updated." }, { "date": "2026-02-20T16:53:39.742020Z", "number": "11", "summary": "Unknown change." }, { "date": "2026-02-20T16:53:41.913091Z", "number": "12", "summary": "NCSC Score updated." }, { "date": "2026-02-20T17:39:37.533735Z", "number": "13", "summary": "References created (3)." }, { "date": "2026-02-20T18:12:34.234550Z", "number": "14", "summary": "References created (3)." }, { "date": "2026-02-20T19:28:49.604692Z", "number": "15", "summary": "Products connected (1).| Product Identifiers created (1).| Exploits created (1)." }, { "date": "2026-02-20T19:28:55.470880Z", "number": "16", "summary": "NCSC Score updated." }, { "date": "2026-02-21T00:28:01.399512Z", "number": "17", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (70).| Product Identifiers created (12).| Products created (1).| References created (5).| CWES updated (1).| Vendor_assessment created." }, { "date": "2026-02-21T00:28:08.975449Z", "number": "18", "summary": "NCSC Score updated." }, { "date": "2026-02-21T12:05:39.938338Z", "number": "19", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products created (1).| References created (4)." }, { "date": "2026-02-21T12:42:52.063164Z", "number": "20", "summary": "Source created.| CVE status created. (valid)| Description created for source." }, { "date": "2026-02-24T00:12:32.781829Z", "number": "21", "summary": "Source created.| CVE status created. (valid)| Description created for source.| References created (4)." }, { "date": "2026-02-24T00:12:42.691076Z", "number": "22", "summary": "NCSC Score updated." }, { "date": "2026-02-26T03:23:42.492502Z", "number": "23", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (64).| Products created (1).| References created (5).| CWES updated (1)." }, { "date": "2026-02-26T03:23:51.340299Z", "number": "24", "summary": "NCSC Score updated." }, { "date": "2026-03-05T00:45:39.320432Z", "number": "25", "summary": "Source connected.| CVE status created. (valid)| Description created for source.| Products connected (2).| References created (19)." }, { "date": "2026-03-20T09:52:59.025983Z", "number": "26", "summary": "Source connected.| CVE status created. (valid)| EPSS created." }, { "date": "2026-03-20T09:53:03.219216Z", "number": "27", "summary": "NCSC Score updated." }, { "date": "2026-03-21T18:47:40.753650Z", "number": "28", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products created (2).| References created (6).| CWES updated (1)." }, { "date": "2026-03-21T18:47:45.226399Z", "number": "29", "summary": "NCSC Score updated." } ], "status": "interim", "version": "29" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/1", "product": { "name": "vers:rpm/1", "product_id": "CSAFPID-5207390", "product_identification_helper": { "cpe": "cpe:/a:redhat:external_secrets_operator:1" } } } ], "category": "product_name", "name": "External Secrets Operator for Red Hat OpenShift" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/1", "product": { "name": "vers:rpm/1", "product_id": "CSAFPID-1919971", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift_pipelines:1" } } } ], "category": "product_name", "name": "OpenShift Pipelines" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/1", "product": { "name": "vers:rpm/1", "product_id": "CSAFPID-1441076", "product_identification_helper": { "cpe": "cpe:/a:redhat:serverless:1" } } } ], "category": "product_name", "name": "OpenShift Serverless" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/2", "product": { "name": "vers:rpm/2", "product_id": "CSAFPID-1441080", "product_identification_helper": { "cpe": "cpe:/a:redhat:acm:2" } } } ], "category": "product_name", "name": "Red Hat Advanced Cluster Management for Kubernetes 2" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/4", "product": { "name": "vers:rpm/4", "product_id": "CSAFPID-1441083", "product_identification_helper": { "cpe": "cpe:/a:redhat:advanced_cluster_security:4" } } } ], "category": "product_name", "name": "Red Hat Advanced Cluster Security 4" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-1439279", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift_ai" } } } ], "category": "product_name", "name": "Red Hat OpenShift AI (RHOAI)" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/4", "product": { "name": "vers:rpm/4", "product_id": "CSAFPID-1439328", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4" } } } ], "category": "product_name", "name": "Red Hat OpenShift Container Platform 4" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/6", "product": { "name": "vers:rpm/6", "product_id": "CSAFPID-1439313", "product_identification_helper": { "cpe": "cpe:/a:redhat:satellite:6" } } } ], "category": "product_name", "name": "Red Hat Satellite 6" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/1", "product": { "name": "vers:rpm/1", "product_id": "CSAFPID-1441204", "product_identification_helper": { "cpe": "cpe:/a:redhat:trusted_artifact_signer:1" } } } ], "category": "product_name", "name": "Red Hat Trusted Artifact Signer" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/1", "product": { "name": "vers:rpm/1", "product_id": "CSAFPID-5414321", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift_security_profiles_operator:1" } } } ], "category": "product_name", "name": "Security Profiles Operator" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/1", "product": { "name": "vers:rpm/1", "product_id": "CSAFPID-5414324", "product_identification_helper": { "cpe": "cpe:/a:redhat:zero_trust_workload_identity_manager:1" } } } ], "category": "product_name", "name": "Zero Trust Workload Identity Manager" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/0", "product": { "name": "vers:rpm/0", "product_id": "CSAFPID-3036204", "product_identification_helper": { "cpe": "cpe:/a:redhat:zero_trust_workload_identity_manager:0" } } } ], "category": "product_name", "name": "Zero Trust Workload Identity Manager - Tech Preview" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-2914773" } } ], "category": "product_name", "name": "acm-prometheus-config-reloader-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-2485143" } } ], "category": "product_name", "name": "acm-prometheus-rhel9" } ], "category": "product_family", "name": "Red Hat Advanced Cluster Management for Kubernetes 2" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-5264795" } } ], "category": "product_name", "name": "bitwarden-sdk-server-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-5264796" } } ], "category": "product_name", "name": "external-secrets-operator-bundle" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-5264797" } } ], "category": "product_name", "name": "external-secrets-operator-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-5207391" } } ], "category": "product_name", "name": "external-secrets-rhel9" } ], "category": "product_family", "name": "External Secrets Operator for Red Hat OpenShift" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-2552057" } } ], "category": "product_name", "name": "client-server-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-1441206" } } ], "category": "product_name", "name": "cosign-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-1441211" } } ], "category": "product_name", "name": "fulcio-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-1441212" } } ], "category": "product_name", "name": "gitsign-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-5157350" } } ], "category": "product_name", "name": "policy-controller-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-1441213" } } ], "category": "product_name", "name": "rekor-backfill-redis-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-1441214" } } ], "category": "product_name", "name": "rekor-cli-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-1441215" } } ], "category": "product_name", "name": "rekor-server-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-1441216" } } ], "category": "product_name", "name": "timestamp-authority-rhel9" } ], "category": "product_family", "name": "Red Hat Trusted Artifact Signer" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-3038249" } } ], "category": "product_name", "name": "cnf-tests-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-1496356" } } ], "category": "product_name", "name": "ztp-site-generate-rhel8" } ], "category": "product_family", "name": "Red Hat OpenShift Container Platform 4" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-5172469" } } ], "category": "product_name", "name": "iop-advisor-backend-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-5222846" } } ], "category": "product_name", "name": "iop-advisor-frontend-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-5656105" } } ], "category": "product_name", "name": "iop-gateway-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-5222848" } } ], "category": "product_name", "name": "iop-host-inventory-frontend-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-5276234" } } ], "category": "product_name", "name": "iop-host-inventory-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-5501147" } } ], "category": "product_name", "name": "iop-ingress-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-5276236" } } ], "category": "product_name", "name": "iop-puptoo-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-5222941" } } ], "category": "product_name", "name": "iop-remediations-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-5458000" } } ], "category": "product_name", "name": "iop-vmaas-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-5276237" } } ], "category": "product_name", "name": "iop-vulnerability-engine-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-5222851" } } ], "category": "product_name", "name": "iop-vulnerability-frontend-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-5276238" } } ], "category": "product_name", "name": "iop-yuptoo-rhel9" } ], "category": "product_family", "name": "Red Hat Satellite 6" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-5414320" } } ], "category": "product_name", "name": "kn-plugin-event-sender-rhel9" } ], "category": "product_family", "name": "OpenShift Serverless" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-1441104" } } ], "category": "product_name", "name": "odh-data-science-pipelines-argo-argoexec-rhel8" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-1441105" } } ], "category": "product_name", "name": "odh-data-science-pipelines-argo-workflowcontroller-rhel8" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-2960950" } } ], "category": "product_name", "name": "odh-model-registry-rhel9" } ], "category": "product_family", "name": "Red Hat OpenShift AI (RHOAI)" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-1919972" } } ], "category": "product_name", "name": "openshift-pipelines-client" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-2855726" } } ], "category": "product_name", "name": "pipelines-chains-controller-rhel8" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-2909323" } } ], "category": "product_name", "name": "pipelines-chains-controller-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-2855727" } } ], "category": "product_name", "name": "pipelines-cli-tkn-rhel8" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-2909324" } } ], "category": "product_name", "name": "pipelines-cli-tkn-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-2855731" } } ], "category": "product_name", "name": "pipelines-git-init-rhel8" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-5068069" } } ], "category": "product_name", "name": "pipelines-opc-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-2909327" } } ], "category": "product_name", "name": "pipelines-operator-bundle" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-2855733" } } ], "category": "product_name", "name": "pipelines-operator-proxy-rhel8" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-2855734" } } ], "category": "product_name", "name": "pipelines-operator-webhook-rhel8" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-2855742" } } ], "category": "product_name", "name": "pipelines-rhel8-operator" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-2909331" } } ], "category": "product_name", "name": "pipelines-rhel9-operator" } ], "category": "product_family", "name": "OpenShift Pipelines" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-5414322" } } ], "category": "product_name", "name": "openshift-security-profiles-operator-bundle" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-5414323" } } ], "category": "product_name", "name": "openshift-security-profiles-rhel8-operator" } ], "category": "product_family", "name": "Security Profiles Operator" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-1441085" } } ], "category": "product_name", "name": "rhacs-main-rhel8" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-1441086" } } ], "category": "product_name", "name": "rhacs-rhel8-operator" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-1441087" } } ], "category": "product_name", "name": "rhacs-roxctl-rhel8" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-1441093" } } ], "category": "product_name", "name": "rhacs-scanner-v4-rhel8" } ], "category": "product_family", "name": "Red Hat Advanced Cluster Security 4" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-5414325" } } ], "category": "product_name", "name": "spiffe-spire-agent-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-5414326" } } ], "category": "product_name", "name": "spiffe-spire-oidc-discovery-provider-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-5414327" } } ], "category": "product_name", "name": "spiffe-spire-server-rhel9" } ], "category": "product_family", "name": "Zero Trust Workload Identity Manager" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-3036207" } } ], "category": "product_name", "name": "spiffe-spire-agent-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-3036209" } } ], "category": "product_name", "name": "spiffe-spire-oidc-discovery-provider-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-3036210" } } ], "category": "product_name", "name": "spiffe-spire-server-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-5414328" } } ], "category": "product_name", "name": "zero-trust-workload-identity-manager-operator-bundle" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-3036211" } } ], "category": "product_name", "name": "zero-trust-workload-identity-manager-rhel9" } ], "category": "product_family", "name": "Zero Trust Workload Identity Manager - Tech Preview" } ], "category": "vendor", "name": "Red Hat" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/>=0|<3.0.5", "product": { "name": "vers:unknown/>=0|<3.0.5", "product_id": "CSAFPID-5658431" } } ], "category": "product_name", "name": "cosign" } ], "category": "vendor", "name": "Bitnami" }, { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/>=0|<3.0.5-150400.3.35.1", "product": { "name": "vers:unknown/>=0|<3.0.5-150400.3.35.1", "product_id": "CSAFPID-5760570" } } ], "category": "product_name", "name": "cosign" } ], "category": "product_family", "name": "SUSE:Linux Enterprise Module for Basesystem 15 SP7" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/>=0|<3.0.5-150400.3.35.1", "product": { "name": "vers:unknown/>=0|<3.0.5-150400.3.35.1", "product_id": "CSAFPID-5760571" } } ], "category": "product_name", "name": "cosign" } ], "category": "product_family", "name": "openSUSE:Leap 15.6" } ], "category": "vendor", "name": "SUSE" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/<3.0.5", "product": { "name": "vers:unknown/<3.0.5", "product_id": "CSAFPID-5642469", "product_identification_helper": { "cpe": "cpe:2.3:a:sigstore:cosign:*:*:*:*:*:*:*:*" } } }, { "category": "product_version_range", "name": "vers:unknown/>=0|<3.0.5", "product": { "name": "vers:unknown/>=0|<3.0.5", "product_id": "CSAFPID-5642564" } }, { "category": "product_version_range", "name": "vers:unknown/cosigned-v0.0.1-dev", "product": { "name": "vers:unknown/cosigned-v0.0.1-dev", "product_id": "CSAFPID-3620594" } }, { "category": "product_version_range", "name": "vers:unknown/cosigned-v0.0.2-dev", "product": { "name": "vers:unknown/cosigned-v0.0.2-dev", "product_id": "CSAFPID-3620595" } }, { "category": "product_version_range", "name": "vers:unknown/cosigned-v0.0.3-dev", "product": { "name": "vers:unknown/cosigned-v0.0.3-dev", "product_id": "CSAFPID-3620596" } }, { "category": "product_version_range", "name": "vers:unknown/v0.1.0", "product": { "name": "vers:unknown/v0.1.0", "product_id": "CSAFPID-3620597" } }, { "category": "product_version_range", "name": "vers:unknown/v0.2.0", "product": { "name": "vers:unknown/v0.2.0", "product_id": "CSAFPID-3620598" } }, { "category": "product_version_range", "name": "vers:unknown/v0.3.0", "product": { "name": "vers:unknown/v0.3.0", "product_id": "CSAFPID-3620599" } }, { "category": "product_version_range", "name": "vers:unknown/v0.3.1", "product": { "name": "vers:unknown/v0.3.1", "product_id": "CSAFPID-3620600" } }, { "category": "product_version_range", "name": "vers:unknown/v0.4.0", "product": { "name": "vers:unknown/v0.4.0", "product_id": "CSAFPID-3620601" } }, { "category": "product_version_range", "name": "vers:unknown/v0.5.0", "product": { "name": "vers:unknown/v0.5.0", "product_id": "CSAFPID-3620602" } }, { "category": "product_version_range", "name": "vers:unknown/v0.6.0", "product": { "name": "vers:unknown/v0.6.0", "product_id": "CSAFPID-3620603" } }, { "category": "product_version_range", "name": "vers:unknown/v1.0.0", "product": { "name": "vers:unknown/v1.0.0", "product_id": "CSAFPID-3620604" } }, { "category": "product_version_range", "name": "vers:unknown/v1.0.1", "product": { "name": "vers:unknown/v1.0.1", "product_id": "CSAFPID-3620605" } }, { "category": "product_version_range", "name": "vers:unknown/v1.1.0", "product": { "name": "vers:unknown/v1.1.0", "product_id": "CSAFPID-3620606" } }, { "category": "product_version_range", "name": "vers:unknown/v1.10.0", "product": { "name": "vers:unknown/v1.10.0", "product_id": "CSAFPID-3620607" } }, { "category": "product_version_range", "name": "vers:unknown/v1.10.0-rc.1", "product": { "name": "vers:unknown/v1.10.0-rc.1", "product_id": "CSAFPID-3620608" } }, { "category": "product_version_range", "name": "vers:unknown/v1.10.1", "product": { "name": "vers:unknown/v1.10.1", "product_id": "CSAFPID-3620609" } }, { "category": "product_version_range", "name": "vers:unknown/v1.11.0", "product": { "name": "vers:unknown/v1.11.0", "product_id": "CSAFPID-3620610" } }, { "category": "product_version_range", "name": "vers:unknown/v1.11.1", "product": { "name": "vers:unknown/v1.11.1", "product_id": "CSAFPID-3620611" } }, { "category": "product_version_range", "name": "vers:unknown/v1.12.0", "product": { "name": "vers:unknown/v1.12.0", "product_id": "CSAFPID-3620612" } }, { "category": "product_version_range", "name": "vers:unknown/v1.12.1", "product": { "name": "vers:unknown/v1.12.1", "product_id": "CSAFPID-3620613" } }, { "category": "product_version_range", "name": "vers:unknown/v1.13.0", "product": { "name": "vers:unknown/v1.13.0", "product_id": "CSAFPID-3620614" } }, { "category": "product_version_range", "name": "vers:unknown/v1.13.1", "product": { "name": "vers:unknown/v1.13.1", "product_id": "CSAFPID-3620615" } }, { "category": "product_version_range", "name": "vers:unknown/v1.2.0", "product": { "name": "vers:unknown/v1.2.0", "product_id": "CSAFPID-3620616" } }, { "category": "product_version_range", "name": "vers:unknown/v1.2.1", "product": { "name": "vers:unknown/v1.2.1", "product_id": "CSAFPID-3620617" } }, { "category": "product_version_range", "name": "vers:unknown/v1.3.0", "product": { "name": "vers:unknown/v1.3.0", "product_id": "CSAFPID-3620618" } }, { "category": "product_version_range", "name": "vers:unknown/v1.3.1", "product": { "name": "vers:unknown/v1.3.1", "product_id": "CSAFPID-3620619" } }, { "category": "product_version_range", "name": "vers:unknown/v1.4.0", "product": { "name": "vers:unknown/v1.4.0", "product_id": "CSAFPID-3620620" } }, { "category": "product_version_range", "name": "vers:unknown/v1.4.1", "product": { "name": "vers:unknown/v1.4.1", "product_id": "CSAFPID-3620621" } }, { "category": "product_version_range", "name": "vers:unknown/v1.5.0", "product": { "name": "vers:unknown/v1.5.0", "product_id": "CSAFPID-3620622" } }, { "category": "product_version_range", "name": "vers:unknown/v1.5.1", "product": { "name": "vers:unknown/v1.5.1", "product_id": "CSAFPID-3620623" } }, { "category": "product_version_range", "name": "vers:unknown/v1.6.0", "product": { "name": "vers:unknown/v1.6.0", "product_id": "CSAFPID-3620624" } }, { "category": "product_version_range", "name": "vers:unknown/v1.7.0", "product": { "name": "vers:unknown/v1.7.0", "product_id": "CSAFPID-3620625" } }, { "category": "product_version_range", "name": "vers:unknown/v1.7.1", "product": { "name": "vers:unknown/v1.7.1", "product_id": "CSAFPID-3620626" } }, { "category": "product_version_range", "name": "vers:unknown/v1.7.2", "product": { "name": "vers:unknown/v1.7.2", "product_id": "CSAFPID-3620627" } }, { "category": "product_version_range", "name": "vers:unknown/v1.8.0", "product": { "name": "vers:unknown/v1.8.0", "product_id": "CSAFPID-3620628" } }, { "category": "product_version_range", "name": "vers:unknown/v1.9.0", "product": { "name": "vers:unknown/v1.9.0", "product_id": "CSAFPID-3620629" } }, { "category": "product_version_range", "name": "vers:unknown/v2.0.0", "product": { "name": "vers:unknown/v2.0.0", "product_id": "CSAFPID-3620630" } }, { "category": "product_version_range", "name": "vers:unknown/v2.0.0-rc.0", "product": { "name": "vers:unknown/v2.0.0-rc.0", "product_id": "CSAFPID-3620631" } }, { "category": "product_version_range", "name": "vers:unknown/v2.0.0-rc.1", "product": { "name": "vers:unknown/v2.0.0-rc.1", "product_id": "CSAFPID-3620632" } }, { "category": "product_version_range", "name": "vers:unknown/v2.0.0-rc.2", "product": { "name": "vers:unknown/v2.0.0-rc.2", "product_id": "CSAFPID-3620633" } }, { "category": "product_version_range", "name": "vers:unknown/v2.0.0-rc.3", "product": { "name": "vers:unknown/v2.0.0-rc.3", "product_id": "CSAFPID-3620634" } }, { "category": "product_version_range", "name": "vers:unknown/v2.0.1", "product": { "name": "vers:unknown/v2.0.1", "product_id": "CSAFPID-3620635" } }, { "category": "product_version_range", "name": "vers:unknown/v2.0.2", "product": { "name": "vers:unknown/v2.0.2", "product_id": "CSAFPID-3620636" } }, { "category": "product_version_range", "name": "vers:unknown/v2.1.0", "product": { "name": "vers:unknown/v2.1.0", "product_id": "CSAFPID-3620637" } }, { "category": "product_version_range", "name": "vers:unknown/v2.1.1", "product": { "name": "vers:unknown/v2.1.1", "product_id": "CSAFPID-3620638" } }, { "category": "product_version_range", "name": "vers:unknown/v2.2.0", "product": { "name": "vers:unknown/v2.2.0", "product_id": "CSAFPID-3620639" } }, { "category": "product_version_range", "name": "vers:unknown/v2.2.1", "product": { "name": "vers:unknown/v2.2.1", "product_id": "CSAFPID-3620640" } }, { "category": "product_version_range", "name": "vers:unknown/v2.2.2", "product": { "name": "vers:unknown/v2.2.2", "product_id": "CSAFPID-3620641" } }, { "category": "product_version_range", "name": "vers:unknown/v2.2.3", "product": { "name": "vers:unknown/v2.2.3", "product_id": "CSAFPID-3620642" } }, { "category": "product_version_range", "name": "vers:unknown/v2.2.4", "product": { "name": "vers:unknown/v2.2.4", "product_id": "CSAFPID-5364818" } }, { "category": "product_version_range", "name": "vers:unknown/v2.3.0", "product": { "name": "vers:unknown/v2.3.0", "product_id": "CSAFPID-5364819" } }, { "category": "product_version_range", "name": "vers:unknown/v2.4.0", "product": { "name": "vers:unknown/v2.4.0", "product_id": "CSAFPID-5364820" } }, { "category": "product_version_range", "name": "vers:unknown/v2.4.1", "product": { "name": "vers:unknown/v2.4.1", "product_id": "CSAFPID-5364821" } }, { "category": "product_version_range", "name": "vers:unknown/v2.4.2", "product": { "name": "vers:unknown/v2.4.2", "product_id": "CSAFPID-5364822" } }, { "category": "product_version_range", "name": "vers:unknown/v2.4.3", "product": { "name": "vers:unknown/v2.4.3", "product_id": "CSAFPID-5364823" } }, { "category": "product_version_range", "name": "vers:unknown/v2.5.0", "product": { "name": "vers:unknown/v2.5.0", "product_id": "CSAFPID-5364824" } }, { "category": "product_version_range", "name": "vers:unknown/v2.5.1", "product": { "name": "vers:unknown/v2.5.1", "product_id": "CSAFPID-5364825" } }, { "category": "product_version_range", "name": "vers:unknown/v2.5.2", "product": { "name": "vers:unknown/v2.5.2", "product_id": "CSAFPID-5364826" } }, { "category": "product_version_range", "name": "vers:unknown/v2.5.3", "product": { "name": "vers:unknown/v2.5.3", "product_id": "CSAFPID-5364827" } }, { "category": "product_version_range", "name": "vers:unknown/v2.6.0", "product": { "name": "vers:unknown/v2.6.0", "product_id": "CSAFPID-5364828" } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.0", "product": { "name": "vers:unknown/v3.0.0", "product_id": "CSAFPID-5364829" } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.1", "product": { "name": "vers:unknown/v3.0.1", "product_id": "CSAFPID-5364830" } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.2", "product": { "name": "vers:unknown/v3.0.2", "product_id": "CSAFPID-5364831" } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.3", "product": { "name": "vers:unknown/v3.0.3", "product_id": "CSAFPID-5364832" } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.4", "product": { "name": "vers:unknown/v3.0.4", "product_id": "CSAFPID-5723574" } } ], "category": "product_name", "name": "cosign" } ], "category": "vendor", "name": "Sigstore" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/3.0.5", "product": { "name": "vers:unknown/3.0.5", "product_id": "CSAFPID-5888538" } }, { "category": "product_version_range", "name": "vers:unknown/<3.0.5", "product": { "name": "vers:unknown/<3.0.5", "product_id": "CSAFPID-5888539" } } ], "category": "product_name", "name": "go/github.com/sigstore/cosign" } ], "category": "vendor", "name": "sigstore" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-24122", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "notes": [ { "category": "description", "text": "Cosign provides code signing and transparency for containers and binaries. In versions 3.0.4 and below, an issuing certificate with a validity that expires before the leaf certificate will be considered valid during verification even if the provided timestamp would mean the issuing certificate should be considered expired. When verifying artifact signatures using a certificate, Cosign first verifies the certificate chain using the leaf certificate's \"not before\" timestamp and later checks expiry of the leaf certificate using either a signed timestamp provided by the Rekor transparency log or from a timestamp authority, or using the current time. The root and all issuing certificates are assumed to be valid during the leaf certificate's validity. There is no impact to users of the public Sigstore infrastructure. This may affect private deployments with customized PKIs. This issue has been fixed in version 3.0.5.", "title": "cveprojectv5 - https://www.cve.org/CVERecord?id=CVE-2026-24122" }, { "category": "description", "text": "## Summary\n\nWhen verifying artifact signatures using a certificate, Cosign first verifies the certificate chain using the leaf certificate's \"not before\" timestamp and later checks expiry of the leaf certificate using either a signed timestamp provided by the Rekor transparency log or from a timestamp authority, or using the current time. The root and all issuing certificates are assumed to be valid during the leaf certificate's validity. An issuing certificate with a validity that expires before the leaf certificate will be considered valid during verification even if the provided timestamp would mean the issuing certificate should be considered expired.\n\n## Impact\n\nNo impact to users of the public Sigstore infrastructure. This may affect private deployments with customized PKIs. In practice, this is unlikely to occur as CAs should not be issuing certificates that outlive the validity of the CA and its parents.\n\n## Workarounds\n\nUpgrade to the latest release, or verify the certificate chain out of band.\n\n## Example to Reproduce\n\n* Root CA certificate is valid from 12pm-2pm\n* Intermediate CA certificate is valid from 12:30pm-1:30pm\n* Leaf certificate is valid from 1pm-3pm - **Note that this is unlikely to happen in practice**, as a CA shouldn't issue a certificate that would be valid after the issuing CA certificate expires\n* Signature generated at 2:30pm with a signed timestamp\n* During verification, the leaf certificate's not before time (1pm) is used to verify the chain - 1pm is in the validity windows for the root and intermediate CA certificates\n* The timestamp's time is checked to be in the validity window of only the leaf certificate - 2:30pm is in the validity window for the leaf\n* Even though the root and intermediate would be expired at 2:30pm, verification succeeds", "title": "github - https://github.com/advisories/GHSA-wfqv-66vq-46rm" }, { "category": "description", "text": "Cosign provides code signing and transparency for containers and binaries. In versions 3.0.4 and below, an issuing certificate with a validity that expires before the leaf certificate will be considered valid during verification even if the provided timestamp would mean the issuing certificate should be considered expired. When verifying artifact signatures using a certificate, Cosign first verifies the certificate chain using the leaf certificate's \"not before\" timestamp and later checks expiry of the leaf certificate using either a signed timestamp provided by the Rekor transparency log or from a timestamp authority, or using the current time. The root and all issuing certificates are assumed to be valid during the leaf certificate's validity. There is no impact to users of the public Sigstore infrastructure. This may affect private deployments with customized PKIs. This issue has been fixed in version 3.0.5.", "title": "nvd - https://nvd.nist.gov/vuln/detail/CVE-2026-24122" }, { "category": "description", "text": "## Summary\n\nWhen verifying artifact signatures using a certificate, Cosign first verifies the certificate chain using the leaf certificate's \"not before\" timestamp and later checks expiry of the leaf certificate using either a signed timestamp provided by the Rekor transparency log or from a timestamp authority, or using the current time. The root and all issuing certificates are assumed to be valid during the leaf certificate's validity. An issuing certificate with a validity that expires before the leaf certificate will be considered valid during verification even if the provided timestamp would mean the issuing certificate should be considered expired.\n\n## Impact\n\nNo impact to users of the public Sigstore infrastructure. This may affect private deployments with customized PKIs. In practice, this is unlikely to occur as CAs should not be issuing certificates that outlive the validity of the CA and its parents.\n\n## Workarounds\n\nUpgrade to the latest release, or verify the certificate chain out of band.\n\n## Example to Reproduce\n\n* Root CA certificate is valid from 12pm-2pm\n* Intermediate CA certificate is valid from 12:30pm-1:30pm\n* Leaf certificate is valid from 1pm-3pm - **Note that this is unlikely to happen in practice**, as a CA shouldn't issue a certificate that would be valid after the issuing CA certificate expires\n* Signature generated at 2:30pm with a signed timestamp\n* During verification, the leaf certificate's not before time (1pm) is used to verify the chain - 1pm is in the validity windows for the root and intermediate CA certificates\n* The timestamp's time is checked to be in the validity window of only the leaf certificate - 2:30pm is in the validity window for the leaf\n* Even though the root and intermediate would be expired at 2:30pm, verification succeeds", "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Go%2FGHSA-wfqv-66vq-46rm.json?alt=media" }, { "category": "description", "text": "A flaw was found in sigstore/cosign. This vulnerability affects private deployments using customized Public Key Infrastructures (PKIs), where it can lead to incorrect validation of artifact signatures. Cosign may mistakenly accept an issuing certificate as valid even if its expiration date precedes the leaf certificate's, potentially allowing invalid signatures to be trusted. This could compromise the integrity of signature verification in affected environments.", "title": "redhat - https://access.redhat.com/security/cve/CVE-2026-24122" }, { "category": "description", "text": "Cosign provides code signing and transparency for containers and binaries. In versions 3.0.4 and below, an issuing certificate with a validity that expires before the leaf certificate will be considered valid during verification even if the provided timestamp would mean the issuing certificate should be considered expired. When verifying artifact signatures using a certificate, Cosign first verifies the certificate chain using the leaf certificate's \"not before\" timestamp and later checks expiry of the leaf certificate using either a signed timestamp provided by the Rekor transparency log or from a timestamp authority, or using the current time. The root and all issuing certificates are assumed to be valid during the leaf certificate's validity. There is no impact to users of the public Sigstore infrastructure. This may affect private deployments with customized PKIs. This issue has been fixed in version 3.0.5.", "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Bitnami%2FBIT-cosign-2026-24122.json?alt=media" }, { "category": "description", "text": "Cosign provides code signing and transparency for containers and binaries. In versions 3.0.4 and below, an issuing certificate with a validity that expires before the leaf certificate will be considered valid during verification even if the provided timestamp would mean the issuing certificate should be considered expired. When verifying artifact signatures using a certificate, Cosign first verifies the certificate chain using the leaf certificate's \"not before\" timestamp and later checks expiry of the leaf certificate using either a signed timestamp provided by the Rekor transparency log or from a timestamp authority, or using the current time. The root and all issuing certificates are assumed to be valid during the leaf certificate's validity. There is no impact to users of the public Sigstore infrastructure. This may affect private deployments with customized PKIs. This issue has been fixed in version 3.0.5.", "title": "debian - https://security-tracker.debian.org/tracker/CVE-2026-24122" }, { "category": "description", "text": "Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign", "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Go%2FGO-2026-4529.json?alt=media" }, { "category": "description", "text": "Cosign provides code signing and transparency for containers and binaries. In versions 3.0.4 and below, an issuing certificate with a validity that expires before the leaf certificate will be considered valid during verification even if the provided timestamp would mean the issuing certificate should be considered expired. When verifying artifact signatures using a certificate, Cosign first verifies the certificate chain using the leaf certificate's \"not before\" timestamp and later checks expiry of the leaf certificate using either a signed timestamp provided by the Rekor transparency log or from a timestamp authority, or using the current time. The root and all issuing certificates are assumed to be valid during the leaf certificate's validity. There is no impact to users of the public Sigstore infrastructure. This may affect private deployments with customized PKIs. This issue has been fixed in version 3.0.5.", "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-24122.json?alt=media" }, { "category": "description", "text": "This update for cosign fixes the following issues:\n\nUpdate to version 3.0.5 (jsc#SLE-23879).\n\nSecurity issues fixed: \n\n- CVE-2025-11065: github.com/go-viper/mapstructure/v2: sensitive Information leak in logs (bsc#1250620).\n- CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption\n (bsc#1253913).\n- CVE-2026-22703: Verification accepts any valid Rekor entry under certain conditions (bsc#1256496).\n- CVE-2026-22772: github.com/sigstore/fulcio: bypass MetaIssuer URL validation bypass can trigger SSRF to arbitrary\n internal services (bsc#1256562).\n- CVE-2026-23991: github.com/theupdateframework/go-tuf/v2: denial of service due to invalid TUF metadata JSON returned\n by TUF repository (bsc#1257080).\n- CVE-2026-23992: github.com/theupdateframework/go-tuf/v2: unauthorized modification to TUF metadata files due to a\n compromised or misconfigured TUF repository (bsc#1257085).\n- CVE-2026-24122: improper validation of certificates that outlive expired CA certificates (bsc#1258542).\n- CVE-2026-24137: github.com/sigstore/sigstore/pkg/tuf: legacy TUF client allows for arbitrary file writes with target\n cache path traversal (bsc#1257139).\n- CVE-2026-26958: filippo.io/edwards25519: failure to initialize receiver in MultiScalarMult can produce invalid results\n and lead to undefined behavior (bsc#1258612).\n\nOther updates and bugfixes:\n\n* chore(deps): bump google.golang.org/api from 0.260.0 to 0.264.0 (#4679)\n* chore(deps): bump github.com/sigstore/rekor-tiles/v2 from 2.0.1 to 2.1.0 (#4670)\n* chore(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1 (#4712)\n* chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4680)\n* chore(deps): bump the gomod group across 1 directory with 4 updates (#4702)\n* chore(deps): bump the actions group with 3 updates (#4703)\n* update golang builder to use go1.25.7 (#4687)\n* update golangci-lint to v2.8.x (#4688)\n* Support DSSE signing conformance test (#4685)\n* chore(deps): bump the actions group across 1 directory with 8 updates (#4689)\n* Deprecate rekor-entry-type flag (#4691)\n* Deprecate cosign triangulate (#4676)\n* Deprecate cosign copy (#4681)\n* Enforce TSA requirement for Rekor v2, Fuclio signing (#4683)\n* chore(deps): bump github.com/theupdateframework/go-tuf/v2 (#4668)\n* chore(deps): bump golang from 1.25.5 to 1.25.6 in the all group (#4673)\n* Automatically require signed timestamp with Rekor v2 entries (#4666)\n* Fix syntax issue in conformance test, update nightly (#4664)\n* Add mTLS support for TSA client connections when signing with a signing config (#4620)\n* fix: avoid panic on malformed tlog entry body (#4652)\n* Verify validity of chain rather than just certificate (#4663)\n* Allow --local-image with --new-bundle-format for v2 and v3 signatures (#4626)\n* chore(deps): bump the gomod group across 1 directory with 3 updates (#4662)\n* Bump sigstore/sigstore to resolve GHSA (#4660)\n* Gracefully fail if bundle payload body is not a string (#4648)\n* fix: avoid panic on malformed replace payload (#4653)\n* chore(deps): bump github.com/sigstore/rekor from 1.4.3 to 1.5.0 (#4659)\n* fix: avoid panic on malformed attestation payload (#4651)\n* fix: avoid panic on malformed tlog entries (#4649)\n* Update conformance to latest\n* docs(cosign): clarify RFC3161 revocation semantics (#4642)\n* Add empty predicate to cosign sign when payload type is application/vnd.in-toto+json (#4635)\n* chore(deps): bump github.com/sigstore/fulcio from 1.8.4 to 1.8.5 (#4637)\n* Add origin key for ctfe trusted root\n* Add changelog updates for v3.0.4 and v2.6.2 (#4625)\n \n- Update to version 3.0.4:\n \n* Fix bundle verify path for old bundle/trusted root (#4623)\n* chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4616)\n* chore(deps): bump cuelang.org/go in the gomod group (#4615)\n* Optimize cosign tree performance by caching digest resolution (#4612)\n* Don't require a trusted root to verify offline with a key (#4613)\n* Support default services for trusted-root and signing-config creation (#4592)\n* chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4602)\n* chore(deps): bump github.com/sigstore/sigstore-go (#4578)\n* chore(deps): bump github.com/buildkite/agent/v3 from 3.114.1 to 3.115.2 (#4601)\n* chore(deps): bump google.golang.org/api from 0.257.0 to 0.258.0 (#4611)\n* chore(deps): bump k8s.io/client-go from 0.34.3 to 0.35.0 (#4604)\n* chore(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 (#4588)\n* chore(deps): bump golang.org/x/oauth2 from 0.33.0 to 0.34.0 (#4586)\n* chore(deps): bump the gomod group with 5 updates (#4599)\n* chore(deps): bump github.com/open-policy-agent/opa from 1.10.1 to 1.12.1 (#4600)\n* chore(deps): bump golang.org/x/term from 0.37.0 to 0.38.0 (#4584)\n* chore(deps): bump the actions group with 3 updates (#4587)\n* chore(deps): bump actions/cache from 4.3.0 to 5.0.1 (#4589)\n* chore(deps): bump the gomod group with 9 updates (#4577)\n \n- Update to version 3.0.3:\n \n* 4554: Closes 4554 - Add warning when --output* is used (#4556)\n* chore(deps): bump golangci/golangci-lint-action from 8.0.0 to 9.1.0 (#4545)\n* chore(deps): bump github.com/buildkite/agent/v3 from 3.111.0 to 3.113.0 (#4542)\n* chore(deps): bump github.com/awslabs/amazon-ecr-credential-helper/ecr-login (#4543)\n* chore(deps): bump actions/checkout from 5.0.0 to 6.0.0 (#4546)\n* chore(deps): bump the actions group with 4 updates (#4544)\n* chore(deps): bump the gomod group across 1 directory with 5 updates (#4567)\n* chore(deps): bump golang from 1.25.4 to 1.25.5 in the all group (#4568)\n* update builder to use go1.25.5 (#4566)\n* Protobuf bundle support for subcommand `clean` (#4539)\n* Add staging flag to initialize with staging TUF metadata\n* update slack invite link (#4560)\n* Updating sign-blob to also support signing with a certificate (#4547)\n* Bump sigstore library dependencies (#4532)\n* Protobuf bundle support for subcommands `save` and `load` (#4538)\n* Fix cert attachment for new bundle with signing config\n* Fix OCI verification with local cert - old bundle\n* chore(deps): bump github.com/sigstore/fulcio from 1.7.1 to 1.8.1 (#4519)\n* chore(deps): bump golang.org/x/crypto in /test/fakeoidc (#4535)\n* chore(deps): bump golang.org/x/crypto from 0.43.0 to 0.45.0 (#4536)\n* update go builder and cosign (#4529)\n* chore(deps): bump the gomod group across 1 directory with 7 updates (#4528)\n* chore(deps): bump sigstore/cosign-installer from 3.10.0 to 4.0.0 (#4478)\n* chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4520)\n* chore(deps): bump golang from 1.25.3 to 1.25.4 in the all group (#4515)\n* chore(deps): bump golang.org/x/oauth2 from 0.32.0 to 0.33.0 (#4518)\n* chore(deps): bump cuelang.org/go from 0.14.2 to 0.15.0 (#4524)\n* chore(deps): bump github.com/open-policy-agent/opa from 1.9.0 to 1.10.1 (#4521)\n* chore(deps): bump actions/upload-artifact from 4.6.2 to 5.0.0 (#4502)\n* chore(deps): bump the actions group across 1 directory with 2 updates (#4516)\n* chore(deps): bump github.com/buildkite/agent/v3 from 3.110.0 to 3.111.0 (#4523)\n* chore(deps): bump github.com/theupdateframework/go-tuf/v2 (#4522)\n* Deprecate tlog-upload flag (#4458)\n* fix: Use signal context for `sign` cli package.\n* update offline verification directions (#4526)\n* Fix signing/verifying annotations for new bundle\n* Add support to download and attach for protobuf bundles (#4477)\n* Add --signing-algorithm flag (#3497)\n* Refactor signcommon bundle helpers\n* Add --bundle and fix --upload for new bundle\n* Pass insecure registry flags through to referrers\n* chore(deps): bump github.com/buildkite/agent/v3 from 3.108.0 to 3.109.1 (#4483)\n* Add protobuf bundle support for tree subcommand (#4491)\n* Remove stale embed import (#4492)\n* Support multiple container identities\n* chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4484)\n* chore(deps): bump chainguard-dev/actions in the actions group (#4480)\n* chore(deps): bump github.com/sigstore/rekor-tiles/v2 (#4485)\n* chore(deps): bump golang.org/x/crypto from 0.42.0 to 0.43.0 (#4486)\n* chore(deps): bump cuelang.org/go in the gomod group (#4479)\n* upgrade OSS-Fuzz build tooling (#4487)\n* Fix segfault when no attestations are found (#4472)\n* Use overridden repository for new bundle format (#4473)\n* update go to 1.25.3 (#4471)\n* Remove --out flag from `cosign initialize` (#4462)\n* chore(deps): bump the actions group with 2 updates (#4460)\n* Deprecate offline flag (#4457)\n* Deduplicate code in sign/attest* and verify* commands (#4449)\n* Cache signing config when calling initialize (#4456)\n* Update changelog for v3.0.2 (#4455)\n* chore(deps): bump google.golang.org/api from 0.250.0 to 0.251.0\n* chore(deps): bump gitlab.com/gitlab-org/api/client-go\n* chore(deps): bump the actions group with 3 updates\n* chore(deps): bump github.com/buildkite/agent/v3 from 3.107.2 to 3.108.0\n* choose different signature filename for KMS-signed release signatures (#4448)\n* chore(deps): bump github.com/go-jose/go-jose/v4 (#4451)\n* Update rekor-tiles version path\n* update CL for v3.0.1 release (#4447)\n* update goreleaser config for v3.0.0 release (#4446)\n* Create changelog for v3.0.0 (#4440)\n* Fetch service URLs from the TUF PGI signing config by default (#4428)\n* Create changelog for v2.6.1 (#4439)\n* chore(deps): bump google.golang.org/api from 0.249.0 to 0.250.0 (#4432)\n* chore(deps): bump the gomod group with 2 updates (#4429)\n* chore(deps): bump github.com/open-policy-agent/opa from 1.8.0 to 1.9.0 (#4433)\n* chore(deps): bump the actions group with 3 updates (#4434)\n* chore(deps): bump github.com/go-openapi/swag from 0.24.1 to 0.25.1 (#4435)\n* chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4436)\n* chore(deps): bump github.com/go-openapi/runtime from 0.28.0 to 0.29.0 (#4437)\n* Bump module version to v3 for Cosign v3.0 (#4427)\n* Move sigstore-conformance back to tagged release (#4425)\n* Bump sigstore-go to v1.1.3 (#4423)\n* Partially populate the output of cosign verify when working with new bundles (#4416)\n* chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4419)\n* chore(deps): bump github.com/theupdateframework/go-tuf/v2 (#4418)\n* chore(deps): bump github.com/buildkite/agent/v3 from 3.105.0 to 3.107.0 (#4420)\n* chore(deps): bump chainguard-dev/actions in the actions group (#4421)\n* bump go builder to use 1.25.1 and cosign (#4417)\n* Bump sigstore-go for more precise user agents (#4413)\n* chore(deps): bump github.com/spf13/viper from 1.20.1 to 1.21.0 (#4408)\n* chore(deps): bump the actions group with 2 updates (#4407)\n* chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4410)\n* chore(deps): bump github.com/buildkite/agent/v3 from 3.104.0 to 3.105.0 (#4411)\n* Default to using the new protobuf format (#4318)\n \n- Update to version 2.6.0:\n \n* Require exclusively a SigningConfig or service URLs when signing (#4403)\n* Add a terminal spinner while signing with sigstore-go (#4402)\n* Bump sigstore-go, support alternative hash algorithms with keys (#4386)\n* Add support for SigningConfig in sign/attest (#4371)\n* Support self-managed keys when signing with sigstore-go (#4368)\n* Remove SHA256 assumption in sign-blob/verify-blob (#4050)\n* introduce dockerfile to pin the go version to decouple go version from go.mod (#4369)\n* refactor: extract function to write referrer attestations (#4357)\n* Break import cycle with e2e build tag (#4370)\n* Update conformance test binary for signing config (#4367)\n* update builder image to use go1.25 (#4366)\n* Don't load content from TUF if trusted root path is specified (#4347)\n* Don't require timestamps when verifying with a key (#4337)\n* Fixes to cosign sign / verify for the new bundle format (#4346)\n* update builder to use go1.24.6 (#4334)\n* bump golangci-lint to v2.3.x (#4333)\n* Have cosign sign support bundle format (#4316)\n* Add support for SigningConfig for sign-blob/attest-blob, support Rekor v2 (#4319)\n* Verify subject with bundle only when checking claims (#4320)\n* Add to `attest-blob` the ability to supply a complete in-toto statement, and add to `verify-blob-attestation` the\n ability to verify with just a digest (#4306)\n", "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/SUSE%2FSUSE-SU-2026:0777-1.json?alt=media" }, { "category": "description", "text": "When verifying artifact signatures using a certificate, Cosign first verifies the certificate chain using the leaf certificate's \"not before\" timestamp and later checks expiry of the leaf certificate using either a signed timestamp provided by the Rekor transparency log or from a timestamp authority, or using the current time. The root and all issuing certificates are assumed to be valid during the leaf certificate's validity. An issuing certificate with a validity that expires before the leaf certificate will be considered valid during verification even if the provided timestamp would mean the issuing certificate should be considered expired.", "title": "gitlab - https://gitlab.com/api/v4/projects/25847700/repository/files/go%2Fgithub.com%2Fsigstore%2Fcosign%2FCVE-2026-24122.yml/raw" }, { "category": "other", "text": "0.0002", "title": "EPSS" }, { "category": "other", "text": "3.8", "title": "NCSC Score" }, { "category": "other", "text": "There is cvss data available from source Redhat", "title": "NCSC Score top increasing factors" }, { "category": "other", "text": "The value of the most recent CVSS (V3) score, The value of the most recent EPSS score, Is related to (a version of) an uncommon product, There is exploit data available from source Nvd", "title": "NCSC Score top decreasing factors" }, { "category": "details", "text": "Severity: 1\n", "title": "Vendor assessment" } ], "product_status": { "fixed": [ "CSAFPID-5888538" ], "known_affected": [ "CSAFPID-5642469", "CSAFPID-5642564", "CSAFPID-5658431", "CSAFPID-3620594", "CSAFPID-3620595", "CSAFPID-3620596", "CSAFPID-3620597", "CSAFPID-3620598", "CSAFPID-3620599", "CSAFPID-3620600", "CSAFPID-3620601", "CSAFPID-3620602", "CSAFPID-3620603", "CSAFPID-3620604", "CSAFPID-3620605", "CSAFPID-3620606", "CSAFPID-3620607", "CSAFPID-3620608", "CSAFPID-3620609", "CSAFPID-3620610", "CSAFPID-3620611", "CSAFPID-3620612", "CSAFPID-3620613", "CSAFPID-3620614", "CSAFPID-3620615", "CSAFPID-3620616", "CSAFPID-3620617", "CSAFPID-3620618", "CSAFPID-3620619", "CSAFPID-3620620", "CSAFPID-3620621", "CSAFPID-3620622", "CSAFPID-3620623", "CSAFPID-3620624", "CSAFPID-3620625", "CSAFPID-3620626", "CSAFPID-3620627", "CSAFPID-3620628", "CSAFPID-3620629", "CSAFPID-3620630", "CSAFPID-3620631", "CSAFPID-3620632", "CSAFPID-3620633", "CSAFPID-3620634", "CSAFPID-3620635", "CSAFPID-3620636", "CSAFPID-3620637", "CSAFPID-3620638", "CSAFPID-3620639", "CSAFPID-3620640", "CSAFPID-3620641", "CSAFPID-3620642", "CSAFPID-5364818", "CSAFPID-5364819", "CSAFPID-5364820", "CSAFPID-5364821", "CSAFPID-5364822", "CSAFPID-5364823", "CSAFPID-5364824", "CSAFPID-5364825", "CSAFPID-5364826", "CSAFPID-5364827", "CSAFPID-5364828", "CSAFPID-5364829", "CSAFPID-5364830", "CSAFPID-5364831", "CSAFPID-5364832", "CSAFPID-5723574", "CSAFPID-5760570", "CSAFPID-5760571", "CSAFPID-5888539" ], "known_not_affected": [ "CSAFPID-1439279", "CSAFPID-1439313", "CSAFPID-1439328", "CSAFPID-1441076", "CSAFPID-1441080", "CSAFPID-1441083", "CSAFPID-1441085", "CSAFPID-1441086", "CSAFPID-1441087", "CSAFPID-1441093", "CSAFPID-1441104", "CSAFPID-1441105", "CSAFPID-1441204", "CSAFPID-1441206", "CSAFPID-1441211", "CSAFPID-1441212", "CSAFPID-1441213", "CSAFPID-1441214", "CSAFPID-1441215", "CSAFPID-1441216", "CSAFPID-1496356", "CSAFPID-1919971", "CSAFPID-1919972", "CSAFPID-2485143", "CSAFPID-2552057", "CSAFPID-2855726", "CSAFPID-2855727", "CSAFPID-2855731", "CSAFPID-2855733", "CSAFPID-2855734", "CSAFPID-2855742", "CSAFPID-2909323", "CSAFPID-2909324", "CSAFPID-2909327", "CSAFPID-2909331", "CSAFPID-2914773", "CSAFPID-2960950", "CSAFPID-3036204", "CSAFPID-3036207", "CSAFPID-3036209", "CSAFPID-3036210", "CSAFPID-3036211", "CSAFPID-3038249", "CSAFPID-5068069", "CSAFPID-5157350", "CSAFPID-5172469", "CSAFPID-5207390", "CSAFPID-5207391", "CSAFPID-5222846", "CSAFPID-5222848", "CSAFPID-5222851", "CSAFPID-5222941", "CSAFPID-5264795", "CSAFPID-5264796", "CSAFPID-5264797", "CSAFPID-5276234", "CSAFPID-5276236", "CSAFPID-5276237", "CSAFPID-5276238", "CSAFPID-5414320", "CSAFPID-5414321", "CSAFPID-5414322", "CSAFPID-5414323", "CSAFPID-5414324", "CSAFPID-5414325", "CSAFPID-5414326", "CSAFPID-5414327", "CSAFPID-5414328", "CSAFPID-5458000", "CSAFPID-5501147", "CSAFPID-5656105" ] }, "references": [ { "category": "external", "summary": "Source - cveprojectv5", "url": "https://www.cve.org/CVERecord?id=CVE-2026-24122" }, { "category": "external", "summary": "Source raw - cveprojectv5", "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/24xxx/CVE-2026-24122.json" }, { "category": "external", "summary": "Source - github", "url": "https://github.com/advisories/GHSA-wfqv-66vq-46rm" }, { "category": "external", "summary": "Source raw - github", "url": "https://api.github.com/advisories/GHSA-wfqv-66vq-46rm" }, { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24122" }, { "category": "external", "summary": "Source raw - nvd", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-24122" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Go%2FGHSA-wfqv-66vq-46rm.json?alt=media" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-24122" }, { "category": "external", "summary": "Source raw - first", "url": "https://api.first.org/data/v1/epss?limit=10000&offset=0" }, { "category": "external", "summary": "Source - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-24122" }, { "category": "external", "summary": "Source raw - redhat", "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-24122.json" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Bitnami%2FBIT-cosign-2026-24122.json?alt=media" }, { "category": "external", "summary": "Source - debian", "url": "https://security-tracker.debian.org/tracker/CVE-2026-24122" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Go%2FGO-2026-4529.json?alt=media" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-24122.json?alt=media" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/SUSE%2FSUSE-SU-2026:0777-1.json?alt=media" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss?limit=10000&offset=0" }, { "category": "external", "summary": "Source - gitlab", "url": "https://gitlab.com/api/v4/projects/25847700/repository/files/go%2Fgithub.com%2Fsigstore%2Fcosign%2FCVE-2026-24122.yml/raw" }, { "category": "external", "summary": "Reference - cveprojectv5; github; gitlab; nvd; osv; redhat", "url": "https://github.com/sigstore/cosign/security/advisories/GHSA-wfqv-66vq-46rm" }, { "category": "external", "summary": "Reference - cveprojectv5; github; gitlab; nvd; osv; redhat", "url": "https://github.com/sigstore/cosign/commit/3c9a7363f563db76d78e2de2cabd945450f3781e" }, { "category": "external", "summary": "Reference - cveprojectv5; github; gitlab; nvd; osv; redhat", "url": "https://github.com/sigstore/cosign/releases/tag/v3.0.5" }, { "category": "external", "summary": "Reference - github; gitlab", "url": "https://github.com/advisories/GHSA-wfqv-66vq-46rm" }, { "category": "external", "summary": "Reference - github; gitlab; osv; redhat", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24122" }, { "category": "external", "summary": "Reference - redhat", "url": "https://www.cve.org/CVERecord?id=CVE-2026-24122" }, { "category": "external", "summary": "Reference - osv", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24122.json" }, { "category": "external", "summary": "Reference - osv", "url": "https://www.suse.com/support/update/announcement/2026/suse-su-20260777-1/" }, { "category": "external", "summary": "Reference - osv", "url": "https://bugzilla.suse.com/1250620" }, { "category": "external", "summary": "Reference - osv", "url": "https://bugzilla.suse.com/1253913" }, { "category": "external", "summary": "Reference - osv", "url": "https://bugzilla.suse.com/1256496" }, { "category": "external", "summary": "Reference - osv", "url": "https://bugzilla.suse.com/1256562" }, { "category": "external", "summary": "Reference - osv", "url": "https://bugzilla.suse.com/1257080" }, { "category": "external", "summary": "Reference - osv", "url": "https://bugzilla.suse.com/1257085" }, { "category": "external", "summary": "Reference - osv", "url": "https://bugzilla.suse.com/1257139" }, { "category": "external", "summary": "Reference - osv", "url": "https://bugzilla.suse.com/1258542" }, { "category": "external", "summary": "Reference - osv", "url": "https://bugzilla.suse.com/1258612" }, { "category": "external", "summary": "Reference - osv", "url": "https://www.suse.com/security/cve/CVE-2025-11065" }, { "category": "external", "summary": "Reference - osv", "url": "https://www.suse.com/security/cve/CVE-2025-58181" }, { "category": "external", "summary": "Reference - osv", "url": "https://www.suse.com/security/cve/CVE-2026-22703" }, { "category": "external", "summary": "Reference - osv", "url": "https://www.suse.com/security/cve/CVE-2026-22772" }, { "category": "external", "summary": "Reference - osv", "url": "https://www.suse.com/security/cve/CVE-2026-23991" }, { "category": "external", "summary": "Reference - osv", "url": "https://www.suse.com/security/cve/CVE-2026-23992" }, { "category": "external", "summary": "Reference - osv", "url": "https://www.suse.com/security/cve/CVE-2026-24122" }, { "category": "external", "summary": "Reference - osv", "url": "https://www.suse.com/security/cve/CVE-2026-24137" }, { "category": "external", "summary": "Reference - osv", "url": "https://www.suse.com/security/cve/CVE-2026-26958" }, { "category": "external", "summary": "Reference - gitlab", "url": "https://github.com/sigstore/cosign" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 3.7, "baseSeverity": "LOW" }, "products": [ "CSAFPID-3620594", "CSAFPID-3620595", "CSAFPID-3620596", "CSAFPID-3620597", "CSAFPID-3620598", "CSAFPID-3620599", "CSAFPID-3620600", "CSAFPID-3620601", "CSAFPID-3620602", "CSAFPID-3620603", "CSAFPID-3620604", "CSAFPID-3620605", "CSAFPID-3620606", "CSAFPID-3620607", "CSAFPID-3620608", "CSAFPID-3620609", "CSAFPID-3620610", "CSAFPID-3620611", "CSAFPID-3620612", "CSAFPID-3620613", "CSAFPID-3620614", "CSAFPID-3620615", "CSAFPID-3620616", "CSAFPID-3620617", "CSAFPID-3620618", "CSAFPID-3620619", "CSAFPID-3620620", "CSAFPID-3620621", "CSAFPID-3620622", "CSAFPID-3620623", "CSAFPID-3620624", "CSAFPID-3620625", "CSAFPID-3620626", "CSAFPID-3620627", "CSAFPID-3620628", "CSAFPID-3620629", "CSAFPID-3620630", "CSAFPID-3620631", "CSAFPID-3620632", "CSAFPID-3620633", "CSAFPID-3620634", "CSAFPID-3620635", "CSAFPID-3620636", "CSAFPID-3620637", "CSAFPID-3620638", "CSAFPID-3620639", "CSAFPID-3620640", "CSAFPID-3620641", "CSAFPID-3620642", "CSAFPID-5364818", "CSAFPID-5364819", "CSAFPID-5364820", "CSAFPID-5364821", "CSAFPID-5364822", "CSAFPID-5364823", "CSAFPID-5364824", "CSAFPID-5364825", "CSAFPID-5364826", "CSAFPID-5364827", "CSAFPID-5364828", "CSAFPID-5364829", "CSAFPID-5364830", "CSAFPID-5364831", "CSAFPID-5364832", "CSAFPID-5642469", "CSAFPID-5642564", "CSAFPID-5658431", "CSAFPID-5723574", "CSAFPID-5760570", "CSAFPID-5760571", "CSAFPID-5888539" ] } ], "title": "CVE-2026-24122" } ] }