CVE-2026-54787
LowAdvisory
Published 31 Jul 2026In the index since 5 Sept 2026
- Severity
- Low
- worst across findings
- CVSS
- 3.1
- base score, highest
- EPSS
- 0.001
- 2nd percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 21
- of 17,957 indexed, latest versions
- Container images
- 21
- deployed by those charts
- Fix available
- 1 of 1
- affected package
sigstore-go fails to check signature timestamps against a signing key's validity period
Carried by container images the latest versions of 21 of 17,957 indexed charts deploy, on 21 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| github.com/ | v0.7.2, v1.1.3, v1.1.4, v1.2.0 | 1.2.1 | 21 |
- OSV records
- GHSA-wqqc-jjcq-vfxm
- Also known as
- GO-2026-6162
Charts affected
21 by stars
Container images carrying it
21 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| goharbor/ | 215c07b71c37 | github.com/ | 1.2.1 | 4 |
| appwrite/ | 34ef77fb6e87 | github.com/ | 1.2.1 | 1 |
| aquasec/ | bcc376de8d77 | github.com/ | 1.2.1 | 1 |
| artifacthub/ | 7d3a91c539dc | github.com/ | 1.2.1 | 1 |
| artifacthub/ | 2d8365601f0e | github.com/ | 1.2.1 | 1 |
| artifacthub/ | 5368d21a6e5c | github.com/ | 1.2.1 | 1 |
| goharbor/ | 5c6f7162804c | github.com/ | 1.2.1 | 1 |
| goharbor/ | d051158f1fd0 | github.com/ | 1.2.1 | 1 |
| library/ | 1ba18449911d | github.com/ | 1.2.1 | 1 |
| prowlercloud/ | 4f252d579be2 | github.com/ | 1.2.1 | 1 |
| securesystemsengineering/ | cef2efbd8bd3 | github.com/ | 1.2.1 | 1 |
| ghcr.io/ | 2b8d06650a1b | github.com/ | 1.2.1 | 1 |
| ghcr.io/ | 6f20d232d596 | github.com/ | 1.2.1 | 1 |
| ghcr.io/ | 6a7a61b37568 | github.com/ | 1.2.1 | 1 |
| ghcr.io/ | a6d5abe94706 | github.com/ | 1.2.1 | 1 |
| ghcr.io/ | 4183bd731bcc | github.com/ | 1.2.1 | 1 |
| ghcr.io/ | 0bcd60beb93f | github.com/ | 1.2.1 | 1 |
| ghcr.io/ | ae8eb69c7b70 | github.com/ | 1.2.1 | 1 |
| ghcr.io/ | d1e914e6d6b9 | github.com/ | 1.2.1 | 1 |
| quay.io/ | 0632c21ddbe4 | github.com/ | 1.2.1 | 1 |
| quay.io/ | 708fe10f099a | github.com/ | 1.2.1 | 1 |