Cosign certificates in versions 3.0.4 and earlier allow an intermediate or issuing certificate that is already expired to be accepted as valid if the leaf certificate has a later expiration and a timestamp may be provided. The validation process first checks the leaf certificate’s “not before” date and later verifies the leaf expiry, assuming all ancestor certificates are valid for that period. Consequently, an attacker could produce a signature chain with an expired intermediate certificate that still passes verification, undermining the integrity of the signed artifacts and the trust model of the system.

The vulnerability affects sigstore cosign deployments running version 3.0.4 or earlier. The issue does not impact the public Sigstore infrastructure but may affect organizations with private deployments that use custom PKIs or custom certificate chains.

The CVSS score of 3.7 indicates moderate severity. EPSS is reported as less than 1 %, showing a very low likelihood of exploitation in the wild, and it is not listed in the CISA KEV catalog. The vulnerability is exploitable during the signature verification phase when an artifact is processed by cosign; an attacker with the ability to supply or forge a certificate chain could bypass expiry checks. The attack likely requires internal or privileged access to the cosign signing workflow or a compromised PKI allowing the creation of expired intermediate certificates. Given the low EPSS, the prevailing risk is moderate but still warrants action.