StackRadar

CVE-2026-54787

Low

Advisory

Published 31 Jul 2026In the index since 5 Sept 2026
Severity
Low
worst across findings
CVSS
3.1
base score, highest
EPSS
0.001
2nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
21
of 17,957 indexed, latest versions
Container images
21
deployed by those charts
Fix available
1 of 1
affected package

sigstore-go fails to check signature timestamps against a signing key's validity period

Carried by container images the latest versions of 21 of 17,957 indexed charts deploy, on 21 images.

Affected packageAffected versionsFixed inImages
github.com/sigstore/sigstore-gogolangv0.7.2, v1.1.3, v1.1.4, v1.2.01.2.121
OSV records
GHSA-wqqc-jjcq-vfxm
Also known as
GO-2026-6162

Charts affected

21 by stars
ChartLatestAffected imagesRadar Score
harborharborOfficialVerified publisher1.19.21 of 8See more

harbor harbor 1.19.2

1 of the 8 container images this version deploys carry CVE-2026-54787.

Container imageDigestPackageFixed in
goharbor/trivy-adapter-photon:v2.15.2215c07b71c37
github.com/sigstore/sigstore-go@v1.1.4
1.2.1

Open the chart page →

1,802
artifact-hubartifact-hubVerified publisher1.23.04 of 7See more

artifact-hub artifact-hub 1.23.0

4 of the 7 container images this version deploys carry CVE-2026-54787.

Container imageDigestPackageFixed in
aquasec/trivy:0.69.3bcc376de8d77
github.com/sigstore/sigstore-go@v1.1.4
1.2.1
artifacthub/hub:v1.23.07d3a91c539dc
github.com/sigstore/sigstore-go@v1.2.0
1.2.1
artifacthub/scanner:v1.23.02d8365601f0e
github.com/sigstore/sigstore-go@v1.1.4
1.2.1
artifacthub/tracker:v1.23.05368d21a6e5c
github.com/sigstore/sigstore-go@v1.2.0
1.2.1

Open the chart page →

11,416
flux2fluxcd-community2.19.11 of 7See more

flux2 fluxcd-community 2.19.1

1 of the 7 container images this version deploys carry CVE-2026-54787.

Container imageDigestPackageFixed in
ghcr.io/fluxcd/source-controller:v1.9.56f20d232d596
github.com/sigstore/sigstore-go@v1.2.0
1.2.1

Open the chart page →

2,622
connaisseurconnaisseurVerified publisher2.13.01 of 2See more

connaisseur connaisseur 2.13.0

1 of the 2 container images this version deploys carry CVE-2026-54787.

Container imageDigestPackageFixed in
securesystemsengineering/connaisseur:v3.13.0cef2efbd8bd3
github.com/sigstore/sigstore-go@v1.1.4
1.2.1

Open the chart page →

3,067
nuclionuclio0.23.91 of 2See more

nuclio nuclio 0.23.9

1 of the 2 container images this version deploys carry CVE-2026-54787.

Container imageDigestPackageFixed in
quay.io/nuclio/dashboard:1.17.9-amd64708fe10f099a
github.com/sigstore/sigstore-go@v1.1.4
1.2.1

Open the chart page →

972
local-ailocalai3.4.21 of 1See more

local-ai localai 3.4.2

1 of the 1 container images this version deploys carry CVE-2026-54787.

Container imageDigestPackageFixed in
quay.io/go-skynet/local-ai:latest0632c21ddbe4
github.com/sigstore/sigstore-go@v1.1.4
1.2.1

Open the chart page →

3,976
policy-controllersigstoreVerified publisher0.10.81 of 2See more

policy-controller sigstore 0.10.8

1 of the 2 container images this version deploys carry CVE-2026-54787.

Container imageDigestPackageFixed in
ghcr.io/sigstore/policy-controller/policy-controllerdigest-pinned0bcd60beb93f
github.com/sigstore/sigstore-go@v0.7.2
1.2.1

Open the chart page →

925
prowlerprowler-appVerified publisher0.0.91 of 5See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry CVE-2026-54787.

Container imageDigestPackageFixed in
prowlercloud/prowler-api:5.31.14f252d579be2
github.com/sigstore/sigstore-go@v1.1.4
1.2.1

Open the chart page →

9,037
harborwener1.19.21 of 8See more

harbor wener 1.19.2

1 of the 8 container images this version deploys carry CVE-2026-54787.

Container imageDigestPackageFixed in
goharbor/trivy-adapter-photon:v2.15.2215c07b71c37
github.com/sigstore/sigstore-go@v1.1.4
1.2.1

Open the chart page →

1,802
harborgpg-dev1.18.31 of 8See more

harbor gpg-dev 1.18.3

1 of the 8 container images this version deploys carry CVE-2026-54787.

Container imageDigestPackageFixed in
goharbor/trivy-adapter-photon:v2.14.35c6f7162804c
github.com/sigstore/sigstore-go@v1.1.4
1.2.1

Open the chart page →

3,492
appwritehelmforgeVerified publisher2.0.21 of 5See more

appwrite helmforge 2.0.2

1 of the 5 container images this version deploys carry CVE-2026-54787.

Container imageDigestPackageFixed in
appwrite/appwrite:2.3.034ef77fb6e87
github.com/sigstore/sigstore-go@v1.1.4
1.2.1

Open the chart page →

4,330
harborhelm-harborVerified publisher2.3.51 of 8See more

harbor helm-harbor 2.3.5

1 of the 8 container images this version deploys carry CVE-2026-54787.

Container imageDigestPackageFixed in
goharbor/trivy-adapter-photon:v2.15.2215c07b71c37
github.com/sigstore/sigstore-go@v1.1.4
1.2.1

Open the chart page →

1,802
kcmkcm1.12.01 of 12See more

kcm kcm 1.12.0

1 of the 12 container images this version deploys carry CVE-2026-54787.

Container imageDigestPackageFixed in
ghcr.io/fluxcd/source-controller:v1.9.22b8d06650a1b
github.com/sigstore/sigstore-go@v1.2.0
1.2.1

Open the chart page →

3,503
litefunctionslitefunctions0.1.11 of 19See more

litefunctions litefunctions 0.1.1

1 of the 19 container images this version deploys carry CVE-2026-54787.

Container imageDigestPackageFixed in
ghcr.io/project-zot/zot:v2.1.144183bd731bcc
github.com/sigstore/sigstore-go@v1.1.3
1.2.1

Open the chart page →

14,684
gitea-runnerm0sh1-helm-charts0.2.31 of 2See more

gitea-runner m0sh1-helm-charts 0.2.3

1 of the 2 container images this version deploys carry CVE-2026-54787.

Container imageDigestPackageFixed in
library/docker:29.3.0-dind-alpine3.231ba18449911d
github.com/sigstore/sigstore-go@v1.1.4
1.2.1

Open the chart page →

4,300
osdfir-infrastructureosdfir-infrastructureVerified publisher2.15.01 of 40See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

1 of the 40 container images this version deploys carry CVE-2026-54787.

Container imageDigestPackageFixed in
ghcr.io/openrelik/openrelik-worker-containers:latesta6d5abe94706
github.com/sigstore/sigstore-go@v1.1.4
1.2.1

Open the chart page →

226,811
portagerportager0.5.01 of 1See more

portager portager 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-54787.

Container imageDigestPackageFixed in
ghcr.io/jarodr47/portager:0.5.06a7a61b37568
github.com/sigstore/sigstore-go@v1.2.0
1.2.1

Open the chart page →

158
sigstore-probersigstoreVerified publisher0.3.11 of 1See more

sigstore-prober sigstore 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-54787.

Container imageDigestPackageFixed in
ghcr.io/sigstore/sigstore-probers/prober:v1.0.1d1e914e6d6b9
github.com/sigstore/sigstore-go@v1.1.4
1.2.1

Open the chart page →

448
tufsigstoreVerified publisher0.1.321 of 1See more

tuf sigstore 0.1.32

1 of the 1 container images this version deploys carry CVE-2026-54787.

Container imageDigestPackageFixed in
ghcr.io/sigstore/scaffolding/serverdigest-pinnedae8eb69c7b70
github.com/sigstore/sigstore-go@v1.1.3
1.2.1

Open the chart page →

771
sikalabs-harbor-master-snapshotsikalabs2023.6.201 of 8See more

sikalabs-harbor-master-snapshot sikalabs 2023.6.20

1 of the 8 container images this version deploys carry CVE-2026-54787.

Container imageDigestPackageFixed in
goharbor/trivy-adapter-photon:devd051158f1fd0
github.com/sigstore/sigstore-go@v1.1.4
1.2.1

Open the chart page →

1,724
harborwenerme1.19.21 of 8See more

harbor wenerme 1.19.2

1 of the 8 container images this version deploys carry CVE-2026-54787.

Container imageDigestPackageFixed in
goharbor/trivy-adapter-photon:v2.15.2215c07b71c37
github.com/sigstore/sigstore-go@v1.1.4
1.2.1

Open the chart page →

1,802

Container images carrying it

21 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
goharbor/trivy-adapter-photon:v2.15.2215c07b71c37
github.com/sigstore/sigstore-go@v1.1.4
1.2.1
4
appwrite/appwrite:2.3.034ef77fb6e87
github.com/sigstore/sigstore-go@v1.1.4
1.2.1
1
aquasec/trivy:0.69.3bcc376de8d77
github.com/sigstore/sigstore-go@v1.1.4
1.2.1
1
artifacthub/hub:v1.23.07d3a91c539dc
github.com/sigstore/sigstore-go@v1.2.0
1.2.1
1
artifacthub/scanner:v1.23.02d8365601f0e
github.com/sigstore/sigstore-go@v1.1.4
1.2.1
1
artifacthub/tracker:v1.23.05368d21a6e5c
github.com/sigstore/sigstore-go@v1.2.0
1.2.1
1
goharbor/trivy-adapter-photon:v2.14.35c6f7162804c
github.com/sigstore/sigstore-go@v1.1.4
1.2.1
1
goharbor/trivy-adapter-photon:devd051158f1fd0
github.com/sigstore/sigstore-go@v1.1.4
1.2.1
1
library/docker:29.3.0-dind-alpine3.231ba18449911d
github.com/sigstore/sigstore-go@v1.1.4
1.2.1
1
prowlercloud/prowler-api:5.31.14f252d579be2
github.com/sigstore/sigstore-go@v1.1.4
1.2.1
1
securesystemsengineering/connaisseur:v3.13.0cef2efbd8bd3
github.com/sigstore/sigstore-go@v1.1.4
1.2.1
1
ghcr.io/fluxcd/source-controller:v1.9.22b8d06650a1b
github.com/sigstore/sigstore-go@v1.2.0
1.2.1
1
ghcr.io/fluxcd/source-controller:v1.9.56f20d232d596
github.com/sigstore/sigstore-go@v1.2.0
1.2.1
1
ghcr.io/jarodr47/portager:0.5.06a7a61b37568
github.com/sigstore/sigstore-go@v1.2.0
1.2.1
1
ghcr.io/openrelik/openrelik-worker-containers:latesta6d5abe94706
github.com/sigstore/sigstore-go@v1.1.4
1.2.1
1
ghcr.io/project-zot/zot:v2.1.144183bd731bcc
github.com/sigstore/sigstore-go@v1.1.3
1.2.1
1
ghcr.io/sigstore/policy-controller/policy-controller0bcd60beb93f
github.com/sigstore/sigstore-go@v0.7.2
1.2.1
1
ghcr.io/sigstore/scaffolding/serverae8eb69c7b70
github.com/sigstore/sigstore-go@v1.1.3
1.2.1
1
ghcr.io/sigstore/sigstore-probers/prober:v1.0.1d1e914e6d6b9
github.com/sigstore/sigstore-go@v1.1.4
1.2.1
1
quay.io/go-skynet/local-ai:latest0632c21ddbe4
github.com/sigstore/sigstore-go@v1.1.4
1.2.1
1
quay.io/nuclio/dashboard:1.17.9-amd64708fe10f099a
github.com/sigstore/sigstore-go@v1.1.4
1.2.1
1

syft 1.42.1 · advisories as of 29 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.