Security features bypass in Cosign - CVE-2026-39395

Vulnerability identifier: #VU125021

CSH Severity: Medium

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-39395

CWE-ID: CWE-254

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to a logic flaw in the error handling of the predicate type validation in cosign verify-blob-attestation. A remote attacker can cause the application to trust the unexpected attestation type.

Cosign
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Basesystem Module
openSUSE Leap
cosign
cosign-debuginfo
cosign-bash-completion
cosign-zsh-completion
cosign-fish-completion

Install updates from vendor's website.

Cosign - addressed in versions 2.6.3, 3.0.6
cosign - update to 3.0.6-150400.3.42.1
cosign-debuginfo - update to 3.0.6-150400.3.42.1
cosign-bash-completion - update to 3.0.6-150400.3.42.1
cosign-zsh-completion - update to 3.0.6-150400.3.42.1
cosign-fish-completion - update to 3.0.6-150400.3.42.1

• https://github.com/sigstore/cosign/security/advisories/GHSA-w6c6-c85g-mmv6

• Security features bypass in Cosign
• SUSE update for cosign