Cosign allows an artifact bundle to be considered verified even when the included Rekor entry does not match the artifact’s digest, signature, or public key. Without these comparisons, a bundle may reference any valid Rekor log entry, resulting in the acceptance of artifacts that have never been legitimately signed. This flaw permits an attacker who has compromised a signing key or identity to insert a crafted repository entry, undermining the integrity guarantees that Cosign is designed to provide.

The vulnerability affects the cosign tool from the sigstore project, specifically versions before 2.6.2 and 3.0.4. Users running these earlier releases must ensure they upgrade to a patched version to mitigate the risk.

The vulnerability has a CVSS score of 5.5, indicating moderate severity, and an EPSS score of less than 1%, signifying a low likelihood of exploitation in current general use. It is not listed in the CISA KEV catalog. Exploitation requires the attacker to supply a crafted Cosign bundle, which typically implies either a pre‑existing compromise of the signing key or malicious local control over the verification process. Given this prerequisite, the practical attack vector is limited to environments where an adversary can influence the verification input or has already gained signing credentials.