Is CVE-2026-44310 actively exploited?

No active exploitation of CVE-2026-44310 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-44310 be exploited remotely?

Yes. CVE-2026-44310 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-44310?

CVE-2026-44310 has a CVSS score of 5.4 (MEDIUM).

HOME VULNERABILITIESCVE-2026-44310

MEDIUM

CVE-2026-44310

CWE-129Published: May 15, 2026· Updated: May 18, 2026

5.4

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:7.3th

Official Description

Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. From 0.4.0 to before 0.15.0, CertVerifier.Verify() in pkg/git/verifier.go unconditionally dereferences certs[0] after sd.GetCertificates() without checking the slice length. A CMS/PKCS7 signed message with an empty certificate set is a structurally valid DER payload; GetCertificates() returns an empty slice with no error, causing an immediate index-out-of-range panic. On the gitsign --verify code path (the GPG-compatible mode invoked by git verify-commit), the panic is silently recovered by internal/io/streams.go's Wrap() function, which returns nil instead of an error. main.go then exits with code 0, causing exit-code-only verification callers to interpret the failed verification as success. This vulnerability is fixed in 0.15.0.

NVD Source

Technical Analysis

CVE-2026-44310 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.