Database/Container, Kubernetes & orchestration
cosign / sigstore: verify-blob-attestation reports "Verified OK" for malformed or mismatched payloads
CVE-2026-39395Container, Kubernetes & orchestrationcurated
Impact
verify-blob-attestation reports "Verified OK" for malformed or mismatched payloads
Who can reach it
Malicious artifact
What to do
Upgrade cosign to 3.0.6/2.6.3+
References
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.