{"vulnerability": "cve-2026-5478", "sightings": [{"uuid": "a663230b-2728-4b50-b455-992c3b509822", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5478", "type": "seen", "source": "https://bsky.app/profile/hurayraiit.com/post/3mjweiuy63s2n", "content": "", "creation_timestamp": "2026-04-20T11:29:53.319212Z"}, {"uuid": "8447d6ad-adcc-44c7-85ed-c70e9d372b83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5478", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mjxcd233br2c", "content": "", "creation_timestamp": "2026-04-20T20:23:25.092183Z"}, {"uuid": "d59ce35b-5aa7-4721-ae15-8d920802a063", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5478", "type": "published-proof-of-concept", "source": "Telegram/OLcxrKJ5zAhC__DZ5T6GCelVB_zr2kWns3QejwnSLKnpZyw", "content": "", "creation_timestamp": "2026-04-20T21:22:19.000000Z"}, {"uuid": "b25b05a0-a45a-498e-b8ae-bb0ffa695a02", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54787", "type": "seen", "source": "https://gist.github.com/alon710/f7703eb7ff99ed9d3ada7f401de565eb", "content": "# CVE-2026-54787: CVE-2026-54787: Insufficient Timestamp Validation in sigstore-go Key Verification Path\n\n> **CVSS Score:** 3.1\n> **Published:** 2026-07-31\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54787\n\n## Summary\nA security vulnerability in sigstore-go prior to version 1.2.1 allowed the use of expired or retired self-managed long-lived public keys wrapped in an ExpiringKey configuration to successfully sign code or artifacts. Because the verification pipeline verified the cryptographic signatures and RFC 3161 timestamps but failed to perform a temporal boundary check on the public key's validity window, verifiers running affected versions would mistakenly accept signatures produced outside of the key's designated operational lifetime.\n\n## TL;DR\nPrior to version 1.2.1, sigstore-go failed to validate signature timestamps against the validity window of self-managed long-lived public keys wrapped in an ExpiringKey configuration. This allowed an attacker with expired or rotated key material to generate accepted signed bundles, effectively bypassing key rotation policies and breaking cryptographic trust guarantees.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-324\n- **Attack Vector**: Network\n- **CVSS**: 3.1 (Low)\n- **EPSS Score**: Not Available\n- **Impact**: Partial Integrity Compromise\n- **Exploit Status**: PoC (Proof-of-Concept) inside official repository\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- sigstore-go\n- **sigstore-go**: < 1.2.1 (Fixed in: `1.2.1`)\n\n## Mitigation\n\n- Upgrade sigstore-go dependency to version 1.2.1 or higher.\n- Ensure verification policies explicitly require at least one verified signed timestamp using verify.WithSignedTimestamps(1) or equivalent.\n- Avoid utilizing verify.WithNoObserverTimestamps() when validating key-signed bundles.\n\n**Remediation Steps:**\n1. Open your project's terminal and execute the update command: go get github.com/sigstore/sigstore-go@v1.2.1\n2. Run go mod tidy to update the go.mod and go.sum configuration files.\n3. Review initialization parameters for verify.NewVerifier and verify.NewPolicy to confirm that timestamp checking is not bypassed.\n4. Recompile and redeploy the verification binaries to your target systems.\n\n## References\n\n- [GHSA-wqqc-jjcq-vfxm Advisory](https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm)\n- [sigstore-go Pull Request 642](https://github.com/sigstore/sigstore-go/pull/642)\n- [Fix Commit 4594ab4c779d08be1f4419803a8249188f35ed5f](https://github.com/sigstore/sigstore-go/commit/4594ab4c779d08be1f4419803a8249188f35ed5f)\n- [sigstore-go v1.2.1 Release Notes](https://github.com/sigstore/sigstore-go/releases/tag/v1.2.1)\n- [CVE-2026-54787 on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-54787)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54787) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-31T22:32:31.622301Z"}, {"uuid": "5c0fbb16-440f-4455-9a59-aa8e4e100c69", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54787", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/5yafsgae3owcl", "content": "CVE-2026-54787 - sigstore-go fails to check signature timestamps against a signing key's validity period\nCVE ID : CVE-2026-54787\n \n Published : July 31, 2026, 11:17 p.m. | 31\u00a0minutes ago\n \n Description : sigstore-go is a Go library for Sigstore signing and verification. Prior ...", "creation_timestamp": "2026-08-01T00:00:23.977586Z"}, {"uuid": "f1e6e9b2-034b-4535-ba80-8b2397073775", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54787", "type": "seen", "source": "https://gist.github.com/alon710/f7703eb7ff99ed9d3ada7f401de565eb", "content": "# CVE-2026-54787: CVE-2026-54787: Insufficient Timestamp Validation in sigstore-go Key Verification Path\n\n> **CVSS Score:** 3.1\n> **Published:** 2026-07-31\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54787\n\n## Summary\nA security vulnerability in sigstore-go prior to version 1.2.1 allowed the use of expired or retired self-managed long-lived public keys wrapped in an ExpiringKey configuration to successfully sign code or artifacts. Because the verification pipeline verified the cryptographic signatures and RFC 3161 timestamps but failed to perform a temporal boundary check on the public key's validity window, verifiers running affected versions would mistakenly accept signatures produced outside of the key's designated operational lifetime.\n\n## TL;DR\nPrior to version 1.2.1, sigstore-go failed to validate signature timestamps against the validity window of self-managed long-lived public keys wrapped in an ExpiringKey configuration. This allowed an attacker with expired or rotated key material to generate accepted signed bundles, effectively bypassing key rotation policies and breaking cryptographic trust guarantees.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-324\n- **Attack Vector**: Network\n- **CVSS**: 3.1 (Low)\n- **EPSS Score**: Not Available\n- **Impact**: Partial Integrity Compromise\n- **Exploit Status**: PoC (Proof-of-Concept) inside official repository\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- sigstore-go\n- **sigstore-go**: < 1.2.1 (Fixed in: `1.2.1`)\n\n## Mitigation\n\n- Upgrade sigstore-go dependency to version 1.2.1 or higher.\n- Ensure verification policies explicitly require at least one verified signed timestamp using verify.WithSignedTimestamps(1) or equivalent.\n- Avoid utilizing verify.WithNoObserverTimestamps() when validating key-signed bundles.\n\n**Remediation Steps:**\n1. Open your project's terminal and execute the update command: go get github.com/sigstore/sigstore-go@v1.2.1\n2. Run go mod tidy to update the go.mod and go.sum configuration files.\n3. Review initialization parameters for verify.NewVerifier and verify.NewPolicy to confirm that timestamp checking is not bypassed.\n4. Recompile and redeploy the verification binaries to your target systems.\n\n## References\n\n- [GHSA-wqqc-jjcq-vfxm Advisory](https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm)\n- [sigstore-go Pull Request 642](https://github.com/sigstore/sigstore-go/pull/642)\n- [Fix Commit 4594ab4c779d08be1f4419803a8249188f35ed5f](https://github.com/sigstore/sigstore-go/commit/4594ab4c779d08be1f4419803a8249188f35ed5f)\n- [sigstore-go v1.2.1 Release Notes](https://github.com/sigstore/sigstore-go/releases/tag/v1.2.1)\n- [CVE-2026-54787 on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-54787)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54787) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-01T00:00:16.243622Z"}, {"uuid": "2adf45a1-255a-49c2-b19a-1e259edff392", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54785", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/fo7qlqdy3jspp", "content": "CVE-2026-54785 - gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode\nCVE ID : CVE-2026-54785\n \n Published : July 31, 2026, 11:17 p.m. | 31\u00a0minutes ago\n \n Description : gemini-bridge is a lightweight MCP server bridging AI agents to G...", "creation_timestamp": "2026-08-01T00:06:24.484779Z"}, {"uuid": "a10f00f4-1d87-4f21-ad5c-6583279b189d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54785", "type": "seen", "source": "https://gist.github.com/alon710/dc2fc48bf583407e8cd73eba1edb4959", "content": "# CVE-2026-54785: CVE-2026-54785: Local File Read via Directory Traversal in gemini-bridge MCP Server\n\n> **CVSS Score:** 6.2\n> **Published:** 2026-07-31\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54785\n\n## Summary\nBetween versions 1.0.0 and 1.3.1, the gemini-bridge Model Context Protocol (MCP) server failed to restrict candidate file paths to the workspace root when processing files in inline mode. This allowed unauthenticated local users, or remote attackers executing prompt-injection payloads against connected AI agents, to traverse the directory tree and read arbitrary system files. The retrieved contents were subsequently forwarded to the external Gemini AI CLI and returned in the round-trip response.\n\n## TL;DR\nA path traversal vulnerability in gemini-bridge allows attackers to read arbitrary local files by exploiting improper canonicalization and a missing validation check in the server's inline payload preprocessor.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Secondary CWE ID**: CWE-200\n- **Attack Vector**: Local\n- **CVSS v3.1 Score**: 6.2\n- **Exploit Maturity**: Proof-of-Concept (PoC)\n- **CISA KEV Status**: Not Listed\n- **Ransomware Use**: No\n\n## Affected Systems\n\n- gemini-bridge installations running versions 1.0.0 through 1.3.0\n- **gemini-bridge**: >= 1.0.0, < 1.3.1 (Fixed in: `1.3.1`)\n\n## Mitigation\n\n- Upgrade gemini-bridge to version 1.3.1 or newer.\n- Restrict the service execution environment to low-privilege user accounts.\n- Containerize the MCP server to restrict absolute directory reach.\n- Sanitize client-side tools to override arbitrary directory arguments supplied by LLMs.\n\n**Remediation Steps:**\n1. Execute pip install --upgrade gemini-bridge to retrieve version 1.3.1.\n2. Verify that the active daemon or integration shell is restarted to load the patched mcp_server module.\n3. Run system-level tests with symbolic links and parent traversal targets to confirm the rejection logic.\n\n## References\n\n- [GitHub Security Advisory (GHSA-c5px-58j2-7fqp)](https://github.com/eLyiN/gemini-bridge/security/advisories/GHSA-c5px-58j2-7fqp)\n- [Pull Request #9](https://github.com/eLyiN/gemini-bridge/pull/9)\n- [Fix Commit (8f3b85a)](https://github.com/eLyiN/gemini-bridge/commit/8f3b85afd02b692c4bc974b5176e12fb277ea801)\n- [Release Tag (v1.3.1)](https://github.com/eLyiN/gemini-bridge/releases/tag/v1.3.1)\n- [CVE Record on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-54785)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54785) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-01T00:31:31.758794Z"}, {"uuid": "044e5b4e-c87a-45bb-9b5c-736d0348013d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54786", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpo37ghk3y22", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-54786 \u0432 Wasmtime: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 WebAssembly\n\n\n\nhttps://kripta.biz/posts/42A2F6AA-355C-43C9-BC5A-A553D65D5219", "creation_timestamp": "2026-07-02T12:53:18.671769Z"}, {"uuid": "341fb038-ba1a-4053-8e1f-bbdd333aac2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54786", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpqj2yuukt2n", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-54786 \u0432 Wasmtime: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 WebAssembly\n\n\n\nhttps://kripta.biz/posts/F77F0A65-ED35-41F0-8927-5548BA0C940C", "creation_timestamp": "2026-07-03T12:06:42.181945Z"}, {"uuid": "39e54b18-9e7f-449f-89be-f9793da2a61a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54786", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpqnmccsm52b", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-54786 \u0432 Wasmtime: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 WebAssembly\n\n\n\nhttps://kripta.biz/posts/73BC507F-DB2F-4CC1-9FEF-C1A8249784F0", "creation_timestamp": "2026-07-03T13:27:57.775241Z"}, {"uuid": "e85742bb-33ab-43a6-a9a6-427c4033a095", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54782", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mq6a55zdqv2t", "content": "CVE-2026-54782 - corewcf.primitives\nAn attacker can use a known vulnerability in CoreWCF to pretend to be any user, including administrators, if they have access to the service and the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#corewcfprimitives #corewcf #dotnet #CVE #infosec", "creation_timestamp": "2026-07-08T23:04:07.092383Z"}, {"uuid": "3cd4f82f-266a-4bed-aaad-a95365c907b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54784", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mq6hv3t6nv2i", "content": "CVE-2026-54784 - CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality\nCVE ID : CVE-2026-54784\n \n Published : July 8, 2026, 11:16 p.m. | 31\u00a0minutes ago\n \n Description : CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to ...", "creation_timestamp": "2026-07-09T01:22:46.293585Z"}, {"uuid": "4bf90a53-e505-495b-a3ef-df65b576ab0c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54781", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mq6iurvqor2z", "content": "CVE-2026-54781 - CoreWCF: SAML SubjectConfirmation methods and holder-of-key proof keys are not enforced\nCVE ID : CVE-2026-54781\n \n Published : July 8, 2026, 11:16 p.m. | 31\u00a0minutes ago\n \n Description : CoreWCF is a port of the service side of Windows Communication Foundation ...", "creation_timestamp": "2026-07-09T01:40:29.764841Z"}, {"uuid": "0e0371a4-21d1-4f8d-9b94-094569fdbeef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54780", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mq6j4hinzz2z", "content": "CVE-2026-54780 - CoreWCF: WS-Security Reference DigestMethod Algorithm-Suite Bypass\nCVE ID : CVE-2026-54780\n \n Published : July 8, 2026, 11:16 p.m. | 31\u00a0minutes ago\n \n Description : CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. P...", "creation_timestamp": "2026-07-09T01:44:47.410861Z"}, {"uuid": "019b19dc-8f14-478b-90c0-7ccec1275fdf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54782", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mq6jffzamm2x", "content": "CVE-2026-54782 - CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation\nCVE ID : CVE-2026-54782\n \n Published : July 8, 2026, 11:16 p.m. | 31\u00a0minutes ago\n \n Description : CoreWCF is a port of the service side of Windows Communication Foundation (WCF...", "creation_timestamp": "2026-07-09T01:49:47.860532Z"}, {"uuid": "5b60f0c8-93d1-404c-90a0-6d017c262753", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54783", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mq6kabger32x", "content": "CVE-2026-54783 - CoreWCF: XML Signature Wrapping in WS-Security endorsing/supporting signature verification allows replay of captured signed messages\nCVE ID : CVE-2026-54783\n \n Published : July 8, 2026, 11:16 p.m. | 31\u00a0minutes ago\n \n Description : CoreWCF is a port of the serv...", "creation_timestamp": "2026-07-09T02:04:49.113795Z"}, {"uuid": "c0386e13-4c3f-4458-9077-dde31abcff1b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54782", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mq6qptuo322j", "content": "\ud83d\udd34 CVE-2026-54782 - Critical (10)\n\nCoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Pri...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-54782/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-09T04:00:54.682812Z"}]}