7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-31830

CVE-2026-31830: sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto subject digest

sigstore-ruby is a pure Ruby implementation of the sigstore verify command from the sigstore/cosign project. Prior to 0.2.3, Sigstore::Verifier#verify does not propagate the VerificationFailure returned by verify_in_toto when the artifact digest does not match the digest in the in-toto attestation subject. As a result, verification of DSSE bundles containing in-toto statements returns VerificationSuccess regardless of whether the artifact matches the attested subject. This vulnerability is fixed in 0.2.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-31830

CVE-2026-31830:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
sigstore	rubygems	< 0.2.3	0.2.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the Sigstore::Verifier.verify method, which fails to check the return value of the Sigstore::Verifier.verify_in_toto method. The advisory GHSA-mhg6-2q2v-9h2c explicitly states that Sigstore::Verifier#verify does not propagate the VerificationFailure from verify_in_toto. I analyzed the commit 2d7dfa262e1eab07e70d5ae5acab320f95eb597d which patches the vulnerability. The patch in lib/sigstore/verifier.rb clearly shows that a check for the return value of verify_in_toto was added to the verify method. Previously, the call was made without any handling of its result. This allowed an attacker to use a validly signed DSSE bundle for one artifact to attest to a different, malicious artifact. The verify_in_toto check would fail, but because the failure was ignored, the overall verification would still succeed. The verify_in_toto function itself was also flawed in its logic for checking subjects and digests, but the core of the vulnerability is the unchecked return value in the verify function. Therefore, both Sigstore::Verifier.verify and Sigstore::Verifier.verify_in_toto are the key functions related to this vulnerability.

Vulnerable functions

Sigstore::Verifier.verify

lib/sigstore/verifier.rb

The `verify` function calls `verify_in_toto` but does not check its return value. This allows a signature verification bypass if the in-toto attestation subject does not match the artifact digest, as the `VerificationFailure` returned by `verify_in_toto` is ignored. The patch fixes this by checking the return value and propagating the failure.

Sigstore::Verifier.verify_in_toto

lib/sigstore/verifier.rb

This function is responsible for verifying the in-toto attestation. The original implementation had several flaws, including incorrect handling of multiple subjects and digest algorithms. When a digest mismatch was found, it would return a `VerificationFailure` object. However, the calling function `verify` ignored this return value, leading to the vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.