Detections
Analytics
SCA: security update for github.com/sigstore/cosign/v2, github.com/sigstore/cosign/v3 (GHSA-whqx-f9j3-ch6m)
medium Tenable Self-Hosted Container Security Plugin ID 436723
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Cosign provides code signing and transparency for containers and binaries. Prior to versions 2.6.2 and
3.0.4, Cosign bundle can be crafted to successfully verify an artifact even if the embedded Rekor entry
does not reference the artifact's digest, signature or public key. When verifying a Rekor entry, Cosign
verifies the Rekor entry signature, and also compares the artifact's digest, the user's public key from
either a Fulcio certificate or provided by the user, and the artifact signature to the Rekor entry
contents. Without these comparisons, Cosign would accept any response from Rekor as valid. A malicious
actor that has compromised a user's identity or signing key could construct a valid Cosign bundle by
including any arbitrary Rekor entry, thus preventing the user from being able to audit the signing event.
This issue has been patched in versions 2.6.2 and 3.0.4. (CVE-2026-22703)
See Also
Plugin Details
Severity: Medium
ID: 436723
Version: Revision 1.4
Type: Local
Family: SCA Checks
Published: 1/13/2026
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.73
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Medium
Base Score: 4.6
Temporal Score: 3.6
Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:C/A:N
CVSS Score Source: CVE-2026-22703
CVSS v3
Risk Factor: Medium
Base Score: 5.5
Temporal Score: 5
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 1/13/2026
Vulnerability Publication Date: 1/10/2026
Reference Information
CVE: CVE-2026-22703
cwe: CWE-345