cosign 3.1.3 and 2.6.5 fix a verification bypass in legacy bundles

What happened on this date

At 01:09 UTC on 2026-08-06, sigstore published cosign v3.1.3 on GitHub (v2.6.5 shipped shortly before), and the same day published advisory GHSA-fx35-mq7g-6g98, "Verification bypass via public key in legacy bundle", rated High (CVSS 3.1 score 7.4) with no CVE listed. According to the advisory, when verify-blob or verify-blob-attestation reads a legacy JSON bundle, a cert field that fails to parse as an X.509 certificate is silently treated as a raw public key. Certificate chain validation and identity policy checks are skipped, flags such as --certificate-identity and --certificate-oidc-issuer are ignored, and verification still reports success with exit code 0. A second effect is that, when --key is passed, a public key in the bundle can replace the trusted key. Affected versions are v2 up to 2.6.4 and v3 up to 3.1.2; OCI image verification and the protobuf bundle format are not affected.

Why it matters for people protecting app logic

More and more independent developers sign release archives, update packages, model files or SBOMs with cosign and verify them in CI or in their update flow. A signature is only worth as much as its verification, and this issue is exactly the case where verification reports success while the identity constraints silently do nothing. If a pipeline verifies an attacker-supplied legacy bundle, a substituted artifact could pass. The advisory also bounds the issue: only legacy JSON bundles and the blob verification commands are affected, and the CVSS vector requires user interaction, meaning someone has to verify a bundle the attacker supplied. The broader lesson is that protecting app logic is not only obfuscation and hardening; integrity checks along the delivery path are a defense too, and that defense depends on keeping its own tools patched.

Concrete checks

First, check the cosign version used by every CI job and release script and upgrade to v2.6.5 or v3.1.3 or later. Second, search the pipeline for verify-blob and verify-blob-attestation calls and find out whether they process legacy JSON bundles; the advisory recommends moving to the standardized protobuf bundle format and verifying with --new-bundle-format, and existing bundles can be converted with cosign bundle create. Third, add a negative test: an artifact signed under the wrong identity must make the verification step fail, and if it does not, treat that as a pipeline bug. Fourth, include signing tools like this in your dependency-update and security-advisory subscriptions.

Your checklist

• Upgrade cosign to v2.6.5 / v3.1.3 or later
• Find pipeline verification calls that handle legacy JSON bundles
• Migrate to protobuf bundles and verify with --new-bundle-format
• Add a negative test: wrong identity must fail verification