Description

In cosign verify-blob and cosign verify-blob-attestation, keyless verification using --certificate-identity and --certificate-oidc-issuer (or their regular expression equivalents) can be bypassed when a legacy JSON --bundle is supplied.

Note that this does not affect verification with the newer standardized bundle format, the default in Cosign v3.

When reading the cert field of a legacy bundle, if the contents failed to parse as an X.509 certificate, Cosign silently fell back to loading the input as a raw public key and populated co.SigVerifier. In downstream verification, whenever co.SigVerifier is set, X.509 certificate chain validation and policy enforcement (CheckCertificatePolicy) are skipped. As a result, --certificate-identity and --certificate-oidc-issuer flags are ignored, and verification succeeds as long as the signature is cryptographically valid for the embedded public key.

Additionally, because the fallback unconditionally assigned to co.SigVerifier, if an operator passed an explicitly trusted --key alongside a legacy bundle containing a public key, the public key embedded in the bundle would overwrite the key provided via --key.

Affected Commands & Formats

• Affected: cosign verify-blob and cosign verify-blob-attestation when verifying legacy JSON bundles (LocalSignedPayload).
• Not Affected:
  • OCI container image verification (cosign verify and cosign verify-attestation).
  • Verification using the modern Sigstore protobuf bundle format (--new-bundle-format, e.g., application/vnd.dev.sigstore.bundle+json).

Impact

An attacker can bypass keyless identity and OIDC issuer pinning in cosign verify-blob and cosign verify-blob-attestation by shipping a legacy bundle whose cert field contains an arbitrary bare public key (-----BEGIN PUBLIC KEY-----) instead of a Fulcio X.509 certificate.

• False assurance of identity enforcement: Verification completes with exit code 0 and reports Verified OK, causing operators or CI/CD pipelines to trust and consume artifacts signed by an unauthorized key.
• Key override: If an operator explicitly specifies --key while verifying against a legacy bundle containing a bare public key, the attacker's bundle key silently overrides --key.

Patches

Upgrade to v3.1.3 or v2.6.5.

Workarounds

Adopt the Standardized Protobuf Bundle Format:

Migrate from legacy JSON bundles to the modern Sigstore protobuf bundle format (--new-bundle-format). The protobuf bundle verification engine is not affected by this vulnerability. You can upgrade bundles with cosign bundle create.