{"api_version":"1","generated_at":"2026-11-13T23:24:28+00:00","cve":"CVE-2026-128035","urls":{"html":"https://cve.report/CVE-2026-128035","api":"https://cve.report/api/cve/CVE-2026-128035.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-128035","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-128035"},"summary":{"title":"gittuf: Propagated controller policies not loaded during verification","description":"In gittuf 0.10.0 through 0.17.0, the verification workflow does not load policy updates that are propagated from an upstream (controller) repository and recorded in the reference state log after the first entry being verified. Only the propagated policy in effect at the start of verification is applied, so later controller changes to global rules, such as threshold requirements and force-push blocks, are ignored and changes that these rules should block pass verification.","state":"PUBLISHED","assigner":"Akrites","published_at":"2026-11-13 16:18:58","updated_at":"2026-11-13 16:18:58"},"problem_types":["CWE-863","CWE-863 CWE-863 Incorrect Authorization"],"metrics":[{"version":"3.1","source":"7fefd608-56a6-419f-a002-fd8543c0710a","type":"Secondary","score":"5.5","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"5.5","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","data":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"}}],"references":[{"url":"https://github.com/gittuf/gittuf/releases/tag/v0.18.0","name":"https://github.com/gittuf/gittuf/releases/tag/v0.18.0","refsource":"7fefd608-56a6-419f-a002-fd8543c0710a","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/gittuf/gittuf/security/advisories/GHSA-pchw-g6rm-gxvh","name":"https://github.com/gittuf/gittuf/security/advisories/GHSA-pchw-g6rm-gxvh","refsource":"7fefd608-56a6-419f-a002-fd8543c0710a","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-128035","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128035","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"gittuf","product":"gittuf","version":"affected 0.10.0 0.18.0 semver","platforms":[]}],"timeline":[],"solutions":[{"source":"CNA","title":"","value":"Upgrade to gittuf 0.18.0 or later, then run gittuf verify-ref over the full history of each protected reference. Policy propagation has been moved back into gittuf's developer mode.","time":"","lang":"en"}],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"collectionURL":"https://pkg.go.dev","defaultStatus":"unaffected","packageName":"github.com/gittuf/gittuf","product":"gittuf","repo":"https://github.com/gittuf/gittuf","vendor":"gittuf","versions":[{"lessThan":"0.18.0","status":"affected","version":"0.10.0","versionType":"semver"}]}],"datePublic":"2026-11-12T19:52:16.000Z","descriptions":[{"lang":"en","value":"In gittuf 0.10.0 through 0.17.0, the verification workflow does not load policy updates that are propagated from an upstream (controller) repository and recorded in the reference state log after the first entry being verified. Only the propagated policy in effect at the start of verification is applied, so later controller changes to global rules, such as threshold requirements and force-push blocks, are ignored and changes that these rules should block pass verification."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-863","description":"CWE-863 Incorrect Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-13T15:20:36.628Z","orgId":"7fefd608-56a6-419f-a002-fd8543c0710a","shortName":"Akrites"},"references":[{"url":"https://github.com/gittuf/gittuf/security/advisories/GHSA-pchw-g6rm-gxvh"},{"url":"https://github.com/gittuf/gittuf/releases/tag/v0.18.0"}],"solutions":[{"lang":"en","value":"Upgrade to gittuf 0.18.0 or later, then run gittuf verify-ref over the full history of each protected reference. Policy propagation has been moved back into gittuf's developer mode."}],"title":"gittuf: Propagated controller policies not loaded during verification","x_generator":{"engine":"cvelib 1.8.0"}}},"cveMetadata":{"assignerOrgId":"7fefd608-56a6-419f-a002-fd8543c0710a","assignerShortName":"Akrites","cveId":"CVE-2026-128035","datePublished":"2026-11-13T15:20:36.628Z","dateReserved":"2026-11-12T20:36:23.291Z","dateUpdated":"2026-11-13T15:20:36.628Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-13 16:18:58","lastModifiedDate":"2026-11-13 16:18:58","problem_types":["CWE-863","CWE-863 CWE-863 Incorrect Authorization"],"metrics":{"cvssMetricV31":[{"source":"7fefd608-56a6-419f-a002-fd8543c0710a","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":3.6}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"128035","Ordinal":"1","Title":"gittuf: Propagated controller policies not loaded during verific","CVE":"CVE-2026-128035","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"128035","Ordinal":"1","NoteData":"In gittuf 0.10.0 through 0.17.0, the verification workflow does not load policy updates that are propagated from an upstream (controller) repository and recorded in the reference state log after the first entry being verified. Only the propagated policy in effect at the start of verification is applied, so later controller changes to global rules, such as threshold requirements and force-push blocks, are ignored and changes that these rules should block pass verification.","Type":"Description","Title":"gittuf: Propagated controller policies not loaded during verific"}]}}}