sigstore framework is a common go library shared across sigstore services and clients. In versions 1.10.3 and below, the legacy TUF client (pkg/tuf/client.go) supports caching target files to disk. It constructs a filesystem path by joining a cache base directory with a target name sourced from signed target metadata; however, it does not validate that the resulting path stays within the cache base directory. A malicious TUF repository can trigger arbitrary file overwriting, limited to the permissions that the calling process has. Note that this should only affect clients that are directly using the TUF client in sigstore/sigstore or are using an older version of Cosign. Public Sigstore deployment users are unaffected, as TUF metadata is validated by a quorum of trusted collaborators. This issue has been fixed in version 1.10.4. As a workaround, users can disable disk caching for the legacy client by setting SIGSTORE_NO_CACHE=true in the environment, migrate to https://github.com/sigstore/sigstore-go/tree/main/pkg/tuf, or upgrade to the latest sigstore/sigstore release.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2609-1 advisory.

    This update for apptainer fixes the following issues

    - CVE-2026-24137: github.com/sigstore/sigstore/pkg/tuf: legacy TUF client allows for arbitrary file writes     with target       cache path traversal (bsc#1264177).
    - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2:
    path pseudo-       header (bsc#1260311).
    - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad     SETTINGS_MAX_FRAME_SIZE       (bsc#1265844).
    - CVE-2026-34986: github.com/go-jose/go-jose/v4,github.com/go-jose/go-jose/v3: crafted JWE input with a     missing       encrypted key can lead to a denial of service (bsc#1262956).
    - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for     validation       bypass and privilege escalation (bsc#1266656).
    - CVE-2026-39827: memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh       (bsc#1266202).
    - CVE-2026-39828: bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266202).
    - CVE-2026-39829: pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266202).
    - CVE-2026-39830: client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh       (bsc#1266202).
    - CVE-2026-39831: bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh       (bsc#1266202).
    - CVE-2026-39832: agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent       (bsc#1266202).
    - CVE-2026-39833: key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266202).
    - CVE-2026-39834: infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266202).
    - CVE-2026-39835: server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266202).
    - CVE-2026-42508: auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts       (bsc#1266202).
    - CVE-2026-46595: VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh       (bsc#1266202).
    - CVE-2026-46597: byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266202).
    - CVE-2026-46598: pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent     (bsc#1266202).
    - CVE-2026-48785: incorrect path matching for limit container paths directive (bsc#1267982).

    Changes for apptainer:

    - Update apptainer to version v1.5.1

     * Work around segmentation fault sometimes seen while `mksquashfs`      under proot is creating a SIF file.
     * Update bundled PRoot to version 5.4.0-rootless.3 in order to      fix a problem where SIF files could be corrupted when      `mksquashfs` died with a signal. The proot command was not      passing back an error exit code.
     * Updated bundled `squashfuse_ll` to version 0.6.2 in order to      fix a crash sometimes seen with apptainer in unprivileged      docker.
     * Update bundled fuse2fs to version 1.47.4 instead of patching      the bugs in 1.47.3.
     * Fix a crash that happened when `/etc/resolv.conf` was a      symlink while building from a definition file using the      localimage bootstrap.
     * Support hosts that have an /etc/resolv.conf symlink pointing      to `../run` in addition to `/run`.
     * Change the download-dependencies script to skip downloading      the PRoot source code on architectures that it is known to      not support (that is: ppc*, s390*, and riscv*).
     In those situations Apptainer will skip trying to compile      and run proot. As a result original owners and groups of      files will not be preserved in SIF images built by      unprivileged users, as was the case for all architectures      prior to 1.5.0.
     * Fix panic encountered during progress bar update while      pulling image.
     * Fix fakeroot overwriting root's username in `/etc/passwd`      with the host user's name, a regression introduced in v1.5.0.
     * Add nonested flag for --mount specifications to prevent      individual bind mounts from being passed to nested containers      via `APPTAINER_BIND`.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-6b87863841 advisory.

    Upstream release 2.98.0. https://github.com/jfrog/jfrog-cli/releases/tag/v2.98.0

    Resolves the following security issues:
    CVE-2025-11579     CVE-2025-66564     CVE-2026-23831     CVE-2026-23991     CVE-2026-23992     CVE-2026-24117     CVE-2026-24137     CVE-2026-24686     CVE-2026-32285     CVE-2026-33762     CVE-2026-34165     CVE-2026-34986

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1507 advisory.

    Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC)     identity. Prior to 1.8.5, Fulcio's metaRegex() function uses unanchored regex, allowing attackers to     bypass MetaIssuer URL validation and trigger SSRF to arbitrary internal services. Since the SSRF only can     trigger GET requests, the request cannot mutate state. The response from the GET request is not returned     to the caller so data exfiltration is not possible. A malicious actor could attempt to probe an internal     network through Blind SSRF. This vulnerability is fixed in 1.8.5. (CVE-2026-22772)

    sigstore framework is a common go library shared across sigstore services and clients. In versions 1.10.3     and below, the legacy TUF client (pkg/tuf/client.go) supports caching target files to disk. It constructs     a filesystem path by joining a cache base directory with a target name sourced from signed target     metadata; however, it does not validate that the resulting path stays within the cache base directory. A     malicious TUF repository can trigger arbitrary file overwriting, limited to the permissions that the     calling process has. Note that this should only affect clients that are directly using the TUF client in     sigstore/sigstore or are using an older version of Cosign. Public Sigstore deployment users are     unaffected, as TUF metadata is validated by a quorum of trusted collaborators. This issue has been fixed     in version 1.10.4. As a workaround, users can disable disk caching for the legacy client by setting     SIGSTORE_NO_CACHE=true in the environment, migrate to https://github.com/sigstore/sigstore-     go/tree/main/pkg/tuf, or upgrade to the latest sigstore/sigstore release. (CVE-2026-24137)

    go-tuf is a Go implementation of The Update Framework (TUF). go-tuf's TAP 4 Multirepo Client uses the map     file repository name string (`repoName`) as a filesystem path component when selecting the local metadata     cache directory. Starting in version 2.0.0 and prior to version 2.4.1, if an application accepts a map     file from an untrusted source, an attacker can supply a `repoName` containing traversal (e.g.,     `../escaped-repo`) and cause go-tuf to create directories and write the root metadata file outside the     intended `LocalMetadataDir` cache base, within the running process's filesystem permissions. Version 2.4.1     contains a patch. (CVE-2026-24686)

    url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
    (CVE-2026-25679)

    On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the     returned FileInfo could reference a file outside of the Root in which the File was opened. The impact of     this escape is limited to reading metadata provided by lstat from arbitrary locations on the filesystem     without permitting reading or writing files outside the root. (CVE-2026-27139)

    Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS     if the meta tag also has an http-equiv attribute with the value refresh. A new GODEBUG setting has been     added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content     attribute which follow url= by setting htmlmetacontenturlescape=0. (CVE-2026-27142)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-de52e7caa1 advisory.

    Update to 2.87.3

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0777-1 advisory.

    Update to version 3.0.5 (jsc#SLE-23879).

    Security issues fixed:

    - CVE-2025-11065: github.com/go-viper/mapstructure/v2: sensitive Information leak in logs (bsc#1250620).
    - CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory     consumption       (bsc#1253913).
    - CVE-2026-22703: Verification accepts any valid Rekor entry under certain conditions (bsc#1256496).
    - CVE-2026-22772: github.com/sigstore/fulcio: bypass MetaIssuer URL validation bypass can trigger SSRF to     arbitrary       internal services (bsc#1256562).
    - CVE-2026-23991: github.com/theupdateframework/go-tuf/v2: denial of service due to invalid TUF metadata     JSON returned       by TUF repository (bsc#1257080).
    - CVE-2026-23992: github.com/theupdateframework/go-tuf/v2: unauthorized modification to TUF metadata files     due to a       compromised or misconfigured TUF repository (bsc#1257085).
    - CVE-2026-24122: improper validation of certificates that outlive expired CA certificates (bsc#1258542).
    - CVE-2026-24137: github.com/sigstore/sigstore/pkg/tuf: legacy TUF client allows for arbitrary file writes     with target       cache path traversal (bsc#1257139).
    - CVE-2026-26958: filippo.io/edwards25519: failure to initialize receiver in MultiScalarMult can produce     invalid results       and lead to undefined behavior (bsc#1258612).

    Other updates and bugfixes:

    * chore(deps): bump google.golang.org/api from 0.260.0 to 0.264.0 (#4679)
    * chore(deps): bump github.com/sigstore/rekor-tiles/v2 from 2.0.1 to 2.1.0 (#4670)
    * chore(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1 (#4712)
    * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4680)
    * chore(deps): bump the gomod group across 1 directory with 4 updates (#4702)
    * chore(deps): bump the actions group with 3 updates (#4703)
    * update golang builder to use go1.25.7 (#4687)
    * update golangci-lint to v2.8.x (#4688)
    * Support DSSE signing conformance test (#4685)
    * chore(deps): bump the actions group across 1 directory with 8 updates (#4689)
    * Deprecate rekor-entry-type flag (#4691)
    * Deprecate cosign triangulate (#4676)
    * Deprecate cosign copy (#4681)
    * Enforce TSA requirement for Rekor v2, Fuclio signing (#4683)
    * chore(deps): bump github.com/theupdateframework/go-tuf/v2 (#4668)
    * chore(deps): bump golang from 1.25.5 to 1.25.6 in the all group (#4673)
    * Automatically require signed timestamp with Rekor v2 entries (#4666)
    * Fix syntax issue in conformance test, update nightly (#4664)
    * Add mTLS support for TSA client connections when signing with a signing config (#4620)
    * fix: avoid panic on malformed tlog entry body (#4652)
    * Verify validity of chain rather than just certificate (#4663)
    * Allow --local-image with --new-bundle-format for v2 and v3 signatures (#4626)
    * chore(deps): bump the gomod group across 1 directory with 3 updates (#4662)
    * Bump sigstore/sigstore to resolve GHSA (#4660)
    * Gracefully fail if bundle payload body is not a string (#4648)
    * fix: avoid panic on malformed replace payload (#4653)
    * chore(deps): bump github.com/sigstore/rekor from 1.4.3 to 1.5.0 (#4659)
    * fix: avoid panic on malformed attestation payload (#4651)
    * fix: avoid panic on malformed tlog entries (#4649)
    * Update conformance to latest
    * docs(cosign): clarify RFC3161 revocation semantics (#4642)
    * Add empty predicate to cosign sign when payload type is application/vnd.in-toto+json (#4635)
    * chore(deps): bump github.com/sigstore/fulcio from 1.8.4 to 1.8.5 (#4637)
    * Add origin key for ctfe trusted root
    * Add changelog updates for v3.0.4 and v2.6.2 (#4625)

    - Update to version 3.0.4:

    * Fix bundle verify path for old bundle/trusted root (#4623)
    * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4616)
    * chore(deps): bump cuelang.org/go in the gomod group (#4615)
    * Optimize cosign tree performance by caching digest resolution (#4612)
    * Don't require a trusted root to verify offline with a key (#4613)
    * Support default services for trusted-root and signing-config creation (#4592)
    * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4602)
    * chore(deps): bump github.com/sigstore/sigstore-go (#4578)
    * chore(deps): bump github.com/buildkite/agent/v3 from 3.114.1 to 3.115.2 (#4601)
    * chore(deps): bump google.golang.org/api from 0.257.0 to 0.258.0 (#4611)
    * chore(deps): bump k8s.io/client-go from 0.34.3 to 0.35.0 (#4604)
    * chore(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 (#4588)
    * chore(deps): bump golang.org/x/oauth2 from 0.33.0 to 0.34.0 (#4586)
    * chore(deps): bump the gomod group with 5 updates (#4599)
    * chore(deps): bump github.com/open-policy-agent/opa from 1.10.1 to 1.12.1 (#4600)
    * chore(deps): bump golang.org/x/term from 0.37.0 to 0.38.0 (#4584)
    * chore(deps): bump the actions group with 3 updates (#4587)
    * chore(deps): bump actions/cache from 4.3.0 to 5.0.1 (#4589)
    * chore(deps): bump the gomod group with 9 updates (#4577)

    - Update to version 3.0.3:

    * 4554: Closes 4554 - Add warning when --output* is used (#4556)
    * chore(deps): bump golangci/golangci-lint-action from 8.0.0 to 9.1.0 (#4545)
    * chore(deps): bump github.com/buildkite/agent/v3 from 3.111.0 to 3.113.0 (#4542)
    * chore(deps): bump github.com/awslabs/amazon-ecr-credential-helper/ecr-login (#4543)
    * chore(deps): bump actions/checkout from 5.0.0 to 6.0.0 (#4546)
    * chore(deps): bump the actions group with 4 updates (#4544)
    * chore(deps): bump the gomod group across 1 directory with 5 updates (#4567)
    * chore(deps): bump golang from 1.25.4 to 1.25.5 in the all group (#4568)
    * update builder to use go1.25.5 (#4566)
    * Protobuf bundle support for subcommand `clean` (#4539)
    * Add staging flag to initialize with staging TUF metadata
    * update slack invite link (#4560)
    * Updating sign-blob to also support signing with a certificate (#4547)
    * Bump sigstore library dependencies (#4532)
    * Protobuf bundle support for subcommands `save` and `load` (#4538)
    * Fix cert attachment for new bundle with signing config
    * Fix OCI verification with local cert - old bundle
    * chore(deps): bump github.com/sigstore/fulcio from 1.7.1 to 1.8.1 (#4519)
    * chore(deps): bump golang.org/x/crypto in /test/fakeoidc (#4535)
    * chore(deps): bump golang.org/x/crypto from 0.43.0 to 0.45.0 (#4536)
    * update go builder and cosign (#4529)
    * chore(deps): bump the gomod group across 1 directory with 7 updates (#4528)
    * chore(deps): bump sigstore/cosign-installer from 3.10.0 to 4.0.0 (#4478)
    * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4520)
    * chore(deps): bump golang from 1.25.3 to 1.25.4 in the all group (#4515)
    * chore(deps): bump golang.org/x/oauth2 from 0.32.0 to 0.33.0 (#4518)
    * chore(deps): bump cuelang.org/go from 0.14.2 to 0.15.0 (#4524)
    * chore(deps): bump github.com/open-policy-agent/opa from 1.9.0 to 1.10.1 (#4521)
    * chore(deps): bump actions/upload-artifact from 4.6.2 to 5.0.0 (#4502)
    * chore(deps): bump the actions group across 1 directory with 2 updates (#4516)
    * chore(deps): bump github.com/buildkite/agent/v3 from 3.110.0 to 3.111.0 (#4523)
    * chore(deps): bump github.com/theupdateframework/go-tuf/v2 (#4522)
    * Deprecate tlog-upload flag (#4458)
    * fix: Use signal context for `sign` cli package.
    * update offline verification directions (#4526)
    * Fix signing/verifying annotations for new bundle
    * Add support to download and attach for protobuf bundles (#4477)
    * Add --signing-algorithm flag (#3497)
    * Refactor signcommon bundle helpers
    * Add --bundle and fix --upload for new bundle
    * Pass insecure registry flags through to referrers
    * chore(deps): bump github.com/buildkite/agent/v3 from 3.108.0 to 3.109.1 (#4483)
    * Add protobuf bundle support for tree subcommand (#4491)
    * Remove stale embed import (#4492)
    * Support multiple container identities
    * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4484)
    * chore(deps): bump chainguard-dev/actions in the actions group (#4480)
    * chore(deps): bump github.com/sigstore/rekor-tiles/v2 (#4485)
    * chore(deps): bump golang.org/x/crypto from 0.42.0 to 0.43.0 (#4486)
    * chore(deps): bump cuelang.org/go in the gomod group (#4479)
    * upgrade OSS-Fuzz build tooling (#4487)
    * Fix segfault when no attestations are found (#4472)
    * Use overridden repository for new bundle format (#4473)
    * update go to 1.25.3 (#4471)
    * Remove --out flag from `cosign initialize` (#4462)
    * chore(deps): bump the actions group with 2 updates (#4460)
    * Deprecate offline flag (#4457)
    * Deduplicate code in sign/attest* and verify* commands (#4449)
    * Cache signing config when calling initialize (#4456)
    * Update changelog for v3.0.2 (#4455)
    * chore(deps): bump google.golang.org/api from 0.250.0 to 0.251.0
    * chore(deps): bump gitlab.com/gitlab-org/api/client-go
    * chore(deps): bump the actions group with 3 updates
    * chore(deps): bump github.com/buildkite/agent/v3 from 3.107.2 to 3.108.0
    * choose different signature filename for KMS-signed release signatures (#4448)
    * chore(deps): bump github.com/go-jose/go-jose/v4 (#4451)
    * Update rekor-tiles version path
    * update CL for v3.0.1 release (#4447)
    * update goreleaser config for v3.0.0 release (#4446)
    * Create changelog for v3.0.0 (#4440)
    * Fetch service URLs from the TUF PGI signing config by default (#4428)
    * Create changelog for v2.6.1 (#4439)
    * chore(deps): bump google.golang.org/api from 0.249.0 to 0.250.0 (#4432)
    * chore(deps): bump the gomod group with 2 updates (#4429)
    * chore(deps): bump github.com/open-policy-agent/opa from 1.8.0 to 1.9.0 (#4433)
    * chore(deps): bump the actions group with 3 updates (#4434)
    * chore(deps): bump github.com/go-openapi/swag from 0.24.1 to 0.25.1 (#4435)
    * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4436)
    * chore(deps): bump github.com/go-openapi/runtime from 0.28.0 to 0.29.0 (#4437)
    * Bump module version to v3 for Cosign v3.0 (#4427)
    * Move sigstore-conformance back to tagged release (#4425)
    * Bump sigstore-go to v1.1.3 (#4423)
    * Partially populate the output of cosign verify when working with new bundles (#4416)
    * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4419)
    * chore(deps): bump github.com/theupdateframework/go-tuf/v2 (#4418)
    * chore(deps): bump github.com/buildkite/agent/v3 from 3.105.0 to 3.107.0 (#4420)
    * chore(deps): bump chainguard-dev/actions in the actions group (#4421)
    * bump go builder to use 1.25.1 and cosign (#4417)
    * Bump sigstore-go for more precise user agents (#4413)
    * chore(deps): bump github.com/spf13/viper from 1.20.1 to 1.21.0 (#4408)
    * chore(deps): bump the actions group with 2 updates (#4407)
    * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4410)
    * chore(deps): bump github.com/buildkite/agent/v3 from 3.104.0 to 3.105.0 (#4411)
    * Default to using the new protobuf format (#4318)

    - Update to version 2.6.0:

    * Require exclusively a SigningConfig or service URLs when signing (#4403)
    * Add a terminal spinner while signing with sigstore-go (#4402)
    * Bump sigstore-go, support alternative hash algorithms with keys (#4386)
    * Add support for SigningConfig in sign/attest (#4371)
    * Support self-managed keys when signing with sigstore-go (#4368)
    * Remove SHA256 assumption in sign-blob/verify-blob (#4050)
    * introduce dockerfile to pin the go version to decouple go version from go.mod (#4369)
    * refactor: extract function to write referrer attestations (#4357)
    * Break import cycle with e2e build tag (#4370)
    * Update conformance test binary for signing config (#4367)
    * update builder image to use go1.25 (#4366)
    * Don't load content from TUF if trusted root path is specified (#4347)
    * Don't require timestamps when verifying with a key (#4337)
    * Fixes to cosign sign / verify for the new bundle format (#4346)
    * update builder to use go1.24.6 (#4334)
    * bump golangci-lint to v2.3.x (#4333)
    * Have cosign sign support bundle format (#4316)
    * Add support for SigningConfig for sign-blob/attest-blob, support Rekor v2 (#4319)
    * Verify subject with bundle only when checking claims (#4320)
    * Add to `attest-blob` the ability to supply a complete in-toto statement, and add to `verify-blob-     attestation` the       ability to verify with just a digest (#4306)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-21a2f3709a advisory.

    Update to 2.87.0



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0592-1 advisory.

    - Update to version 0.4.1+git78.f951e3a:
    - CVE-2025-22868: Unexpected memory consumption during token parsing in golang.org/x/oauth2. (bsc#1239186)
    - CVE-2024-45337: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in     golang.org/x/crypto. (bsc#1234486)
    - CVE-2025-27144: Go JOSE's Parsing Vulnerable to Denial of Service. (bsc#1237611)
    - CVE-2025-22870: proxy bypass using IPv6 zone IDs. (bsc#1238683)
    - CVE-2025-22869: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh. (bsc#1239323)
    - CVE-2025-30204: jwt-go allows excessive memory allocation during header parsing. (bsc#1240444)
    - CVE-2025-58181: invalidated number of mechanisms can cause unbounded memory consumption. (bsc#1253802)
    - CVE-2026-22772: MetaIssuer URL validation bypass can trigger SSRF to arbitrary internal services.
    (bsc#1256535)
    - CVE-2026-24137: legacy TUF client allows for arbitrary file writes with target cache path traversal.
    (bsc#1257138)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - sigstore framework is a common go library shared across sigstore services and clients. In versions 1.10.3     and below, the legacy TUF client (pkg/tuf/client.go) supports caching target files to disk. It constructs     a filesystem path by joining a cache base directory with a target name sourced from signed target     metadata; however, it does not validate that the resulting path stays within the cache base directory. A     malicious TUF repository can trigger arbitrary file overwriting, limited to the permissions that the     calling process has. Note that this should only affect clients that are directly using the TUF client in     sigstore/sigstore or are using an older version of Cosign. Public Sigstore deployment users are     unaffected, as TUF metadata is validated by a quorum of trusted collaborators. This issue has been fixed     in version 1.10.4. As a workaround, users can disable disk caching for the legacy client by setting     SIGSTORE_NO_CACHE=true in the environment, migrate to https://github.com/sigstore/sigstore-     go/tree/main/pkg/tuf, or upgrade to the latest sigstore/sigstore release. (CVE-2026-24137)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - sigstore framework is a common go library shared across sigstore services and clients. In versions 1.10.3
    and below, the legacy TUF client (pkg/tuf/client.go) supports caching target files to disk. It constructs
    a filesystem path by joining a cache base directory with a target name sourced from signed target
    metadata; however, it does not validate that the resulting path stays within the cache base directory. A
    malicious TUF repository can trigger arbitrary file overwriting, limited to the permissions that the
    calling process has. Note that this should only affect clients that are directly using the TUF client in
    sigstore/sigstore or are using an older version of Cosign. Public Sigstore deployment users are
    unaffected, as TUF metadata is validated by a quorum of trusted collaborators. This issue has been fixed
    in version 1.10.4. As a workaround, users can disable disk caching for the legacy client by setting
    SIGSTORE_NO_CACHE=true in the environment, migrate to https://github.com/sigstore/sigstore-
    go/tree/main/pkg/tuf, or upgrade to the latest sigstore/sigstore release. (CVE-2026-24137)

ID	Name	Product	Family	Severity
323089	SUSE SLES15 Security Update : apptainer (SUSE-SU-2026:2609-1)	Nessus	SuSE Local Security Checks	high
315032	openSUSE 16 Security Update : apptainer (openSUSE-SU-2026:20730-1)	Nessus	SuSE Local Security Checks	high
311385	Fedora 44 : jfrog-cli (2026-6b87863841)	Nessus	Fedora Local Security Checks	high
304588	Amazon Linux 2023 : runfinch-finch (ALAS2023-2026-1507)	Nessus	Amazon Linux Local Security Checks	medium
301422	Fedora 42 : gh (2026-de52e7caa1)	Nessus	Fedora Local Security Checks	high
301024	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : cosign (SUSE-SU-2026:0777-1)	Nessus	SuSE Local Security Checks	medium
300473	Fedora 43 : gh (2026-21a2f3709a)	Nessus	Fedora Local Security Checks	high
299709	openSUSE 15 Security Update : vexctl (SUSE-SU-2026:0592-1)	Nessus	SuSE Local Security Checks	high
296929	Linux Distros Unpatched Vulnerability : CVE-2026-24137	Nessus	Misc.	medium
436910	SCA: security update for github.com/sigstore/sigstore (GHSA-fcv2-xgw5-pqxf)	Tenable Cloud Security	SCA Checks	medium
436910	SCA: security update for github.com/sigstore/sigstore (GHSA-fcv2-xgw5-pqxf)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2026-24137

medium

Tenable Plugins

high

high

high

medium

high

medium

high

high

medium

medium

medium