4.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44544

CVE-2026-44544: gittuf: Policy can be rolled back to prior valid version

gittuf is a platform-agnostic Git security system. Prior to 0.14.0, an attacker with push access to gittuf's Reference State Log (RSL) can roll back the current policy to any previous policy trusted by the current set of root keys. gittuf determines the policy to load by inspecting the RSL. Except for the very first policy (which is automatically trusted given gittuf's TOFU model, or verified against manually specified keys), whenever an RSL entry that points to a new policy is encountered, gittuf validates that this policy is trusted. This is done by checking that the new policy’s root metadata is signed by the required threshold of the current policy's root keys. Because of this, an attacker with push access to the RSL may create a new entry that references an old policy (that is trusted by the most recent policy's set of root keys), thereby rolling back gittuf's policy to the attacker's chosen state. This vulnerability is fixed in 0.14.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44544

CVE-2026-44544:

4.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/gittuf/gittuf	go	<= 0.13.1	0.14.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability in gittuf allows an attacker with push access to the Reference State Log (RSL) to roll back the security policy to a previously valid version. This is a logic flaw in the policy verification process. When a new policy is introduced, gittuf is supposed to verify it. However, the verification logic was missing a crucial step: checking if the 'new' policy was actually older than the current one.

The vulnerable function is policy.State.VerifyNewState, located in internal/policy/verify.go. This function is called to validate a new policy state. Before the fix, it would check signatures and other validity criteria but failed to compare version numbers. An attacker could create a new RSL entry pointing to an old policy commit, and VerifyNewState would approve it as long as it was signed by keys trusted by the current policy.

The patch addresses this by introducing a monotonically increasing version number in the policy metadata. The VerifyNewState function was modified to call a new function, VerifyNewStateMetadata, which explicitly checks that the version of the incoming policy is greater than or equal to the version of the current policy. If this check fails, it returns a new ErrMetadataRollbackDetected error, preventing the rollback attack.

Vulnerable functions

State.VerifyNewState

internal/policy/verify.go

This function is responsible for verifying a new policy state against the current one. Before the patch, it lacked a check to ensure the version of the new policy was not older than the current one. An attacker could exploit this by submitting an older, but still trusted, policy. The `VerifyNewState` function would have incorrectly approved this change, leading to a policy rollback. The vulnerability is the missing version check.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.