{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-128035", "assignerOrgId": "7fefd608-56a6-419f-a002-fd8543c0710a", "state": "PUBLISHED", "assignerShortName": "Akrites", "dateReserved": "2026-11-12T20:36:23.291Z", "datePublished": "2026-11-13T15:20:36.628Z", "dateUpdated": "2026-11-13T15:20:36.628Z"}, "containers": {"cna": {"title": "gittuf: Propagated controller policies not loaded during verification", "datePublic": "2026-11-12T19:52:16.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization", "type": "CWE"}]}], "affected": [{"vendor": "gittuf", "product": "gittuf", "collectionURL": "https://pkg.go.dev", "packageName": "github.com/gittuf/gittuf", "repo": "https://github.com/gittuf/gittuf", "versions": [{"status": "affected", "version": "0.10.0", "lessThan": "0.18.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "In gittuf 0.10.0 through 0.17.0, the verification workflow does not load policy updates that are propagated from an upstream (controller) repository and recorded in the reference state log after the first entry being verified. Only the propagated policy in effect at the start of verification is applied, so later controller changes to global rules, such as threshold requirements and force-push blocks, are ignored and changes that these rules should block pass verification."}], "references": [{"url": "https://github.com/gittuf/gittuf/security/advisories/GHSA-pchw-g6rm-gxvh"}, {"url": "https://github.com/gittuf/gittuf/releases/tag/v0.18.0"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 5.5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"}}], "solutions": [{"lang": "en", "value": "Upgrade to gittuf 0.18.0 or later, then run gittuf verify-ref over the full history of each protected reference. Policy propagation has been moved back into gittuf's developer mode."}], "providerMetadata": {"orgId": "7fefd608-56a6-419f-a002-fd8543c0710a", "shortName": "Akrites", "dateUpdated": "2026-11-13T15:20:36.628Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected", "packageName": "github.com/gittuf/gittuf", "product": "gittuf", "repo": "https://github.com/gittuf/gittuf", "vendor": "gittuf", "versions": [{"lessThan": "0.18.0", "status": "affected", "version": "0.10.0", "versionType": "semver"}]}], "source": "7fefd608-56a6-419f-a002-fd8543c0710a"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In gittuf 0.10.0 through 0.17.0, the verification workflow does not load policy updates that are propagated from an upstream (controller) repository and recorded in the reference state log after the first entry being verified. Only the propagated policy in effect at the start of verification is applied, so later controller changes to global rules, such as threshold requirements and force-push blocks, are ignored and changes that these rules should block pass verification."}], "id": "CVE-2026-128035", "lastModified": "2026-11-13T16:18:58.940", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "7fefd608-56a6-419f-a002-fd8543c0710a", "type": "Secondary"}]}, "published": "2026-11-13T16:18:58.833", "references": [{"source": "7fefd608-56a6-419f-a002-fd8543c0710a", "url": "https://github.com/gittuf/gittuf/releases/tag/v0.18.0"}, {"source": "7fefd608-56a6-419f-a002-fd8543c0710a", "url": "https://github.com/gittuf/gittuf/security/advisories/GHSA-pchw-g6rm-gxvh"}], "sourceIdentifier": "7fefd608-56a6-419f-a002-fd8543c0710a", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "7fefd608-56a6-419f-a002-fd8543c0710a", "type": "Secondary"}]}

{}

{}