Cosign provides code signing and transparency for containers and binaries. Prior to 3.0.6 and 2.6.3, cosign verify-blob-attestation may erroneously report a "Verified OK" result for attestations with malformed payloads or mismatched predicate types. For old-format bundles and detached signatures, this was due to a logic flaw in the error handling of the predicate type validation. For new-format bundles, the predicate type validation was bypassed completely. This vulnerability is fixed in 3.0.6 and 2.6.3.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-5358fb95a0 advisory.

    Upgrade to 4.4.2 upstream version.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:2365-1 advisory.

    This update for cosign fixes the following issue

    - CVE-2026-39395: Incorrect attestation verification due to malformed payloads or mismatched predicate     types       (bsc#1261859).

    Changes for cosign:

    - update to 3.0.6:
     * Fix DSSE predicate check (GHSA-w6c6-c85g-mmv6) (#4801)
     * Handle whitespace-only certificate annotation (#4760)
     * fix(sign): closing SignerVerifier too early when signing with      a security key (#4761)
     * Disallow --new-bundle-format and --rfc3161-timestamp (#4762)
     * support managed keys in conformance testing (#4728)
     * Add support for GCE metadata server env var (#4732)
     * fix: preserve per-layer annotations in      WriteAttestationsReferrer (#4709)
     * Fix parsing of in-toto for string predicates
     * Mark batch of flags for deprecation (#4698)
     * disallow key and cert identity being used together      during verification (#4636)
     * support key creation in GitLab group (#4704)
    - Set CGO_ENABLED=1 for fixing s390x failed build
    - build against a maintained golang version (upstream uses go1.20)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Cosign provides code signing and transparency for containers and binaries. Prior to versions 2.6.2 and
    3.0.4, Cosign bundle can be crafted to successfully verify an artifact even if the embedded Rekor entry
    does not reference the artifact's digest, signature or public key. When verifying a Rekor entry, Cosign
    verifies the Rekor entry signature, and also compares the artifact's digest, the user's public key from
    either a Fulcio certificate or provided by the user, and the artifact signature to the Rekor entry
    contents. Without these comparisons, Cosign would accept any response from Rekor as valid. A malicious
    actor that has compromised a user's identity or signing key could construct a valid Cosign bundle by
    including any arbitrary Rekor entry, thus preventing the user from being able to audit the signing event.
    This issue has been patched in versions 2.6.2 and 3.0.4. (CVE-2026-22703)

  - Cosign provides code signing and transparency for containers and binaries. Prior to 3.0.6 and 2.6.3,
    cosign verify-blob-attestation may erroneously report a "Verified OK" result for attestations with
    malformed payloads or mismatched predicate types. For old-format bundles and detached signatures, this was
    due to a logic flaw in the error handling of the predicate type validation. For new-format bundles, the
    predicate type validation was bypassed completely. This vulnerability is fixed in 3.0.6 and 2.6.3.
    (CVE-2026-39395)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Cosign provides code signing and transparency for containers and binaries. Prior to 3.0.6 and 2.6.3,
    cosign verify-blob-attestation may erroneously report a "Verified OK" result for attestations with
    malformed payloads or mismatched predicate types. For old-format bundles and detached signatures, this was
    due to a logic flaw in the error handling of the predicate type validation. For new-format bundles, the
    predicate type validation was bypassed completely. This vulnerability is fixed in 3.0.6 and 2.6.3.
    (CVE-2026-39395)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Cosign provides code signing and transparency for containers and binaries. Prior to 3.0.6 and 2.6.3,     cosign verify-blob-attestation may erroneously report a Verified OK result for attestations with     malformed payloads or mismatched predicate types. For old-format bundles and detached signatures, this was     due to a logic flaw in the error handling of the predicate type validation. For new-format bundles, the     predicate type validation was bypassed completely. This vulnerability is fixed in 3.0.6 and 2.6.3.
    (CVE-2026-39395)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
321737	Fedora 43 : singularity-ce (2026-5358fb95a0)	Nessus	Fedora Local Security Checks	high
321040	SUSE SLED15 / SLES15 Security Update : cosign (SUSE-SU-2026:2365-1)	Nessus	SuSE Local Security Checks	medium
441757	Alpine: multiple cosign packages: security update to 2.6.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
441757	Alpine: multiple cosign packages: security update to 2.6.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
440001	SCA: security update for github.com/sigstore/cosign (GHSA-w6c6-c85g-mmv6)	Tenable Cloud Security	SCA Checks	medium
440001	SCA: security update for github.com/sigstore/cosign (GHSA-w6c6-c85g-mmv6)	Tenable Self-Hosted Container Security	SCA Checks	medium
305573	Linux Distros Unpatched Vulnerability : CVE-2026-39395	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-39395

medium

Tenable Plugins

high

medium

medium

medium

medium

medium

medium