CVE-2026-39395

OVERVIEW CVE-2026-39395 is a verification bypass vulnerability in Cosign, a container and binary code signing tool. The flaw affects versions prior to 3.0.6 and 2.6.3, allowing the verify-blob-attestation function to incorrectly report successful verification for attestations with malformed payloads or mismatched predicate types. The vulnerability stems from logic flaws in predicate type validation for legacy bundle formats and complete validation bypass in newer bundle formats. SEVERITY This vulnerability carries a CVSS score of 5.3 (Medium) with a network-based attack vector requiring no authentication or user interaction. The attack complexity is low, meaning an attacker can exploit this flaw with relative ease. The primary impact is integrity-focused: an attacker could distribute falsely verified attestations, potentially allowing malicious code to be trusted as legitimate. No confidentiality or availability impacts are expected. EXPLOITATION STATUS The vulnerability is not currently being actively exploited in the wild. No known exploit code is publicly available, and the CVE has not appeared on CISA's Known Exploited Vulnerabilities list. Community attention remains minimal, reflected in the low EPSS score of 0.00038, indicating this vulnerability represents a lower exploitation probability compared to other disclosed CVEs. Organizations should update to the patched versions when feasible, but this is not an urgent critical threat.