sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated (Rekor entry) time) against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verification spec. The old sigstore-conformance test for this check was built incorrectly. This vulnerability impacts only users verifying bundles with `dev.sigstore:sigstore-java:2.0.0`. Older versions are not affected; it is fixed in `dev.sigstore:sigstore-java:2.1.0` A malicious actor may exploit this if they were able to access a users system and exfiltrate the temporary private key used during signing and then reuse an old fulcio certificate later without requiring direct access to the user's credentials. Users may protect themselves by re-verifying their artifacts using the newest sigstore-java or another current sigstore client. Transparency logs may also be audited for unauthorized signatures for a suspected reused identity.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0     erroneously removed verification of the integrated (Rekor entry) time) against the Fulcio certificate.
    Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verification spec.
    The old sigstore-conformance test for this check was built incorrectly. This vulnerability impacts only     users verifying bundles with `dev.sigstore:sigstore-java:2.0.0`. Older versions are not affected; it is     fixed in `dev.sigstore:sigstore-java:2.1.0` A malicious actor may exploit this if they were able to access     a users system and exfiltrate the temporary private key used during signing and then reuse an old fulcio     certificate later without requiring direct access to the user's credentials. Users may protect themselves     by re-verifying their artifacts using the newest sigstore-java or another current sigstore client.
    Transparency logs may also be audited for unauthorized signatures for a suspected reused identity.
    (CVE-2026-48791)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0
    erroneously removed verification of the integrated (Rekor entry) time) against the Fulcio certificate.
    Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verification spec.
    The old sigstore-conformance test for this check was built incorrectly. This vulnerability impacts only
    users verifying bundles with `dev.sigstore:sigstore-java:2.0.0`. Older versions are not affected; it is
    fixed in `dev.sigstore:sigstore-java:2.1.0` A malicious actor may exploit this if they were able to access
    a users system and exfiltrate the temporary private key used during signing and then reuse an old fulcio
    certificate later without requiring direct access to the user's credentials. Users may protect themselves
    by re-verifying their artifacts using the newest sigstore-java or another current sigstore client.
    Transparency logs may also be audited for unauthorized signatures for a suspected reused identity.
    (CVE-2026-48791)

ID	Name	Product	Family	Type	Severity
335296	Linux Distros Unpatched Vulnerability : CVE-2026-48791	Nessus	Misc.	Local	low
444146	SCA: security update for dev.sigstore:sigstore-java (GHSA-qqw8-7c2r-jxch)	Tenable Cloud Security	SCA Checks	Local	low
444146	SCA: security update for dev.sigstore:sigstore-java (GHSA-qqw8-7c2r-jxch)	Tenable Self-Hosted Container Security	SCA Checks	Local	low

Detections

Analytics

CVE-2026-48791

low

Tenable Plugins

low

low

low