The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - sigstore framework is a common go library shared across sigstore services and clients. In versions 1.10.3     and below, the legacy TUF client (pkg/tuf/client.go) supports caching target files to disk. It constructs     a filesystem path by joining a cache base directory with a target name sourced from signed target     metadata; however, it does not validate that the resulting path stays within the cache base directory. A     malicious TUF repository can trigger arbitrary file overwriting, limited to the permissions that the     calling process has. Note that this should only affect clients that are directly using the TUF client in     sigstore/sigstore or are using an older version of Cosign. Public Sigstore deployment users are     unaffected, as TUF metadata is validated by a quorum of trusted collaborators. This issue has been fixed     in version 1.10.4. As a workaround, users can disable disk caching for the legacy client by setting     SIGSTORE_NO_CACHE=true in the environment, migrate to https://github.com/sigstore/sigstore-     go/tree/main/pkg/tuf, or upgrade to the latest sigstore/sigstore release. (CVE-2026-24137)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-24137

medium Nessus Plugin ID 296929

Version 1.3

Version 1.2

Version 1.1

Version 1.3 Feb 7, 2026, 9:06 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202602070906
Version 1.2 Jan 31, 2026, 11:07 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202601311107
Version 1.1 Jan 28, 2026, 8:38 AM New Plugin Feed: 202601280838