Cosign, a tool for signing and verifying container images and binaries, incorrectly reports a "Verified OK" result when the payload of an attestation is malformed or does not match the expected predicate type. The flaw lies in error handling for old‑format bundles and in bypassing validation for new‑format bundles, resulting in attestation bypass. An attacker can supply a crafted payload that the system accepts as valid, potentially allowing malicious binaries to be trusted as legitimate.

The vulnerability affects sigstore cosign versions prior to 3.0.6 and 2.6.3. Any deployment using these releases and performing blob attestation verification is impacted.

The CVSS score of 4.3 indicates a moderate severity, but the EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Attacker advantage is limited to creating the impression of a valid signature; exploitation requires that the victim run cosign verify‑blob‑attestation on attacker‑controlled data. The likelihood of exploitation remains uncertain, though the potential to mislead trust chains is significant when the environment relies solely on cosign for attestation validation.