CVE-2026-54787: sigstore-go fails to check signature timestamps against a signing key's validity period

CVE-2026-54787 is a vulnerability in sigstore-go fails to check signature timestamps against a signing key's validity period, with a CVSS 3.1 base score of 3.1 (Low). An attacker can exploit it remotely over the network, with low privileges and without user interaction. Microsoft has not reported exploitation in the wild. The EPSS model estimates a 0.13% probability of exploitation activity in the next 30 days, higher than 3% of all scored vulnerabilities. Microsoft released the fix on 6 August 2026, outside Patch Tuesday. It affects 1 product in 1 product family (Open Source Software).

Key facts

CVE ID: CVE-2026-54787
Severity: Low CVSS 3.1
Exploited in the wild: No
Publicly disclosed: No
Weakness: CWE-324
EPSS: 0.13% (percentile 3%)
CISA KEV: Not listed
Released: 6 August 2026
Last updated: 23 August 2026
Patch Tuesday: July 2026 Patch Tuesday
Product families: Open Source Software

CVSS score and vector

Microsoft scores CVE-2026-54787 at 3.1 (temporal 3.1) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Metric	Value
Attack vector	Network
Attack complexity	High
Privileges required	Low
User interaction	None
Scope	Unchanged
Confidentiality impact	None
Integrity impact	Low
Availability impact	None

Affected products (1)

Open Source Software

Product	Security update	Type	Fixed build	Restart
azl3 gh 2.62.0-20 on Azure Linux 3.0	CBL-Mariner Releases	Security Update	2.97.0-1	No

NIST NVD data

NVD status: Awaiting Analysis
NVD CVSS: 3.1 (LOW)
NVD weakness: CWE-324
Published to NVD: 31 July 2026
NVD last modified: 23 October 2026

References

Revision history

Version	Date	Description
1.0	6 August 2026	Information published.
2.0	23 August 2026	Information published.