Vulnerability-Lookup

CVE-2026-44544 (GCVE-0-2026-44544)

Vulnerability from cvelistv5 – Published: 2026-05-14 17:34 – Updated: 2026-05-15 18:05

Title

gittuf: Policy can be rolled back to prior valid version

Summary

gittuf is a platform-agnostic Git security system. Prior to 0.14.0, an attacker with push access to gittuf's Reference State Log (RSL) can roll back the current policy to any previous policy trusted by the current set of root keys. gittuf determines the policy to load by inspecting the RSL. Except for the very first policy (which is automatically trusted given gittuf's TOFU model, or verified against manually specified keys), whenever an RSL entry that points to a new policy is encountered, gittuf validates that this policy is trusted. This is done by checking that the new policy’s root metadata is signed by the required threshold of the current policy's root keys. Because of this, an attacker with push access to the RSL may create a new entry that references an old policy (that is trusted by the most recent policy's set of root keys), thereby rolling back gittuf's policy to the attacker's chosen state. This vulnerability is fixed in 0.14.0.

Severity ?

4.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

GitHub_M

References

2 references

URL	Tags
https://github.com/gittuf/gittuf/security/advisor…	x_refsource_CONFIRM
https://github.com/gittuf/gittuf/commit/dd76efa50…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
gittuf	gittuf	Affected: < 0.14.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-44544",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-15T16:44:10.097846Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-15T18:05:22.406Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "gittuf",
          "vendor": "gittuf",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.14.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "gittuf is a platform-agnostic Git security system. Prior to 0.14.0, an attacker with push access to gittuf\u0027s Reference State Log (RSL) can roll back the current policy to any previous policy trusted by the current set of root keys. gittuf determines the policy to load by inspecting the RSL. Except for the very first policy (which is automatically trusted given gittuf\u0027s TOFU model, or verified against manually specified keys), whenever an RSL entry that points to a new policy is encountered, gittuf validates that this policy is trusted. This is done by checking that the new policy\u2019s root metadata is signed by the required threshold of the current policy\u0027s root keys. Because of this, an attacker with push access to the RSL may create a new entry that references an old policy (that is trusted by the most recent policy\u0027s set of root keys), thereby rolling back gittuf\u0027s policy to the attacker\u0027s chosen state.  This vulnerability is fixed in 0.14.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-14T17:34:39.692Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/gittuf/gittuf/security/advisories/GHSA-vxvc-cg7j-rwqj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/gittuf/gittuf/security/advisories/GHSA-vxvc-cg7j-rwqj"
        },
        {
          "name": "https://github.com/gittuf/gittuf/commit/dd76efa505f9137a4a9a625c5ac67b333365a1b8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/gittuf/gittuf/commit/dd76efa505f9137a4a9a625c5ac67b333365a1b8"
        }
      ],
      "source": {
        "advisory": "GHSA-vxvc-cg7j-rwqj",
        "discovery": "UNKNOWN"
      },
      "title": "gittuf: Policy can be rolled back to prior valid version"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-44544",
    "datePublished": "2026-05-14T17:34:39.692Z",
    "dateReserved": "2026-05-06T19:38:10.568Z",
    "dateUpdated": "2026-05-15T18:05:22.406Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-44544",
      "date": "2026-05-23",
      "epss": "0.00043",
      "percentile": "0.13361"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-44544\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-05-14T18:16:50.297\",\"lastModified\":\"2026-05-14T18:27:25.110\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"gittuf is a platform-agnostic Git security system. Prior to 0.14.0, an attacker with push access to gittuf\u0027s Reference State Log (RSL) can roll back the current policy to any previous policy trusted by the current set of root keys. gittuf determines the policy to load by inspecting the RSL. Except for the very first policy (which is automatically trusted given gittuf\u0027s TOFU model, or verified against manually specified keys), whenever an RSL entry that points to a new policy is encountered, gittuf validates that this policy is trusted. This is done by checking that the new policy\u2019s root metadata is signed by the required threshold of the current policy\u0027s root keys. Because of this, an attacker with push access to the RSL may create a new entry that references an old policy (that is trusted by the most recent policy\u0027s set of root keys), thereby rolling back gittuf\u0027s policy to the attacker\u0027s chosen state.  This vulnerability is fixed in 0.14.0.\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":4.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"HIGH\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-639\"}]}],\"references\":[{\"url\":\"https://github.com/gittuf/gittuf/commit/dd76efa505f9137a4a9a625c5ac67b333365a1b8\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/gittuf/gittuf/security/advisories/GHSA-vxvc-cg7j-rwqj\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-44544\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-15T16:44:10.097846Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-05-15T16:44:14.864Z\"}}], \"cna\": {\"title\": \"gittuf: Policy can be rolled back to prior valid version\", \"source\": {\"advisory\": \"GHSA-vxvc-cg7j-rwqj\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 4.9, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"LOW\", \"subIntegrityImpact\": \"HIGH\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"gittuf\", \"product\": \"gittuf\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 0.14.0\"}]}], \"references\": [{\"url\": \"https://github.com/gittuf/gittuf/security/advisories/GHSA-vxvc-cg7j-rwqj\", \"name\": \"https://github.com/gittuf/gittuf/security/advisories/GHSA-vxvc-cg7j-rwqj\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/gittuf/gittuf/commit/dd76efa505f9137a4a9a625c5ac67b333365a1b8\", \"name\": \"https://github.com/gittuf/gittuf/commit/dd76efa505f9137a4a9a625c5ac67b333365a1b8\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"gittuf is a platform-agnostic Git security system. Prior to 0.14.0, an attacker with push access to gittuf\u0027s Reference State Log (RSL) can roll back the current policy to any previous policy trusted by the current set of root keys. gittuf determines the policy to load by inspecting the RSL. Except for the very first policy (which is automatically trusted given gittuf\u0027s TOFU model, or verified against manually specified keys), whenever an RSL entry that points to a new policy is encountered, gittuf validates that this policy is trusted. This is done by checking that the new policy\\u2019s root metadata is signed by the required threshold of the current policy\u0027s root keys. Because of this, an attacker with push access to the RSL may create a new entry that references an old policy (that is trusted by the most recent policy\u0027s set of root keys), thereby rolling back gittuf\u0027s policy to the attacker\u0027s chosen state.  This vulnerability is fixed in 0.14.0.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-639\", \"description\": \"CWE-639: Authorization Bypass Through User-Controlled Key\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-05-14T17:34:39.692Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-44544\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-15T18:05:22.406Z\", \"dateReserved\": \"2026-05-06T19:38:10.568Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-05-14T17:34:39.692Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-44544

Vulnerability from fkie_nvd - Published: 2026-05-14 18:16 - Updated: 2026-05-14 18:27

Severity ?

4.9 (Medium) - CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/gittuf/gittuf/commit/dd76efa505f9137a4a9a625c5ac67b333365a1b8
	security-advisories@github.com	https://github.com/gittuf/gittuf/security/advisories/GHSA-vxvc-cg7j-rwqj

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "gittuf is a platform-agnostic Git security system. Prior to 0.14.0, an attacker with push access to gittuf\u0027s Reference State Log (RSL) can roll back the current policy to any previous policy trusted by the current set of root keys. gittuf determines the policy to load by inspecting the RSL. Except for the very first policy (which is automatically trusted given gittuf\u0027s TOFU model, or verified against manually specified keys), whenever an RSL entry that points to a new policy is encountered, gittuf validates that this policy is trusted. This is done by checking that the new policy\u2019s root metadata is signed by the required threshold of the current policy\u0027s root keys. Because of this, an attacker with push access to the RSL may create a new entry that references an old policy (that is trusted by the most recent policy\u0027s set of root keys), thereby rolling back gittuf\u0027s policy to the attacker\u0027s chosen state.  This vulnerability is fixed in 0.14.0."
    }
  ],
  "id": "CVE-2026-44544",
  "lastModified": "2026-05-14T18:27:25.110",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "HIGH",
          "attackRequirements": "PRESENT",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 4.9,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "HIGH",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-05-14T18:16:50.297",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/gittuf/gittuf/commit/dd76efa505f9137a4a9a625c5ac67b333365a1b8"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/gittuf/gittuf/security/advisories/GHSA-vxvc-cg7j-rwqj"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-VXVC-CG7J-RWQJ

Vulnerability from github – Published: 2026-05-07 03:34 – Updated: 2026-05-14 20:54

Summary

gittuf's policy can be rolled back to prior valid versions

Details

Summary

An attacker with push access to gittuf's Reference State Log (RSL) can roll back the current policy to any previous policy trusted by the current set of root keys.

Impact

gittuf determines the policy to load by inspecting the RSL. Except for the very first policy (which is automatically trusted given gittuf's TOFU model, or verified against manually specified keys), whenever an RSL entry that points to a new policy is encountered, gittuf validates that this policy is trusted. This is done by checking that the new policy’s root metadata is signed by the required threshold of the current policy's root keys.

Because of this, an attacker with push access to the RSL may create a new entry that references an old policy (that is trusted by the most recent policy's set of root keys), thereby rolling back gittuf's policy to the attacker's chosen state.

Note that the attacker cannot roll back the policy to one that would no longer be trusted by the most recent policy's root keys. As an example, say that Policy A's root keys were for Alice and Bob with a threshold of two, and then Policy B replaced Bob with Carol, with a threshold of two required. An attacker would not be able to roll back the policy to policy A, because it was signed by Alice and Bob, not Alice and Carol.

If you host your repository on a forge such as GitHub, GitLab, Bitbucket, etc., and only certain people are allowed to push to the RSL (e.g. only maintainers of your project have push access to the repository, and all other contributions must be done via pull request), then only those users with push access can perform the attack, or the forge itself.

Fix

gittuf version v0.14.0 introduces a monotonically increasing number to all policy metadata (not to be confused with the metadata version, which dictates the features supported by the metadata). This number is incremented whenever a gittuf client of version v0.14.0 or greater updates the metadata or invokes a patch command to add this field.

During policy verification, gittuf compares the monotonically increasing number of the new policy it encounters in the RSL to the current policy. If any file in the policy (e.g. root of trust, primary policy file, or delegated policy file) has this number, gittuf will check that it increases by one any time the respective file is changed.

Resolution

Upgrade gittuf and Apply Metadata Patch

gittuf strongly recommends users upgrade to the latest version to remediate this vulnerability. Specifically, gittuf version v0.14.0 (and above) are patched with respect to this vulnerability. All users who use gittuf to verify the repository or update its policy metadata must upgrade to prevent this attack.

After a consuming application applies the upgrade, a root of trust user or policy administrator must run:

gittuf trust increment-version

or:

gittuf policy increment-version

to add the monotonically increasing number field to the metadata (see Fix above).

Check for Rollback Attack Attempts

Because this attack requires the attacker to add an entry to the RSL, and because gittuf stores the RSL inside the repository, this attack cannot be performed without leaving evidence behind (in this case, the malicious RSL entry). To check for whether this attack was performed on your repository, run:

gittuf rsl log --ref refs/gittuf/policy

All RSL entries that record new policy states for gittuf should be displayed. There should be one RSL entry every time a legitimate, new policy was applied. Should users find an RSL entry which points to an older policy state, their repository has been compromised.

Credits

gittuf thanks Andrew Nesbitt (@andrew) for finding and responsibly disclosing this vulnerability.

Severity ?

6.0 (Medium)


                  
                    CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.13.1"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/gittuf/gittuf"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.14.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-44544"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-07T03:34:13Z",
    "nvd_published_at": "2026-05-14T18:16:50Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nAn attacker with push access to gittuf\u0027s Reference State Log (RSL) can roll back the current policy to any previous policy trusted by the current set of root keys.\n\n## Impact\n\ngittuf determines the policy to load by inspecting the RSL. Except for the very first policy (which is automatically trusted given gittuf\u0027s TOFU model, or verified against manually specified keys), whenever an RSL entry that points to a new policy is encountered, gittuf validates that this policy is trusted. This is done by checking that the new policy\u2019s root metadata is signed by the required threshold of the current policy\u0027s root keys.\n\nBecause of this, an attacker with push access to the RSL may create a new entry that references an old policy (that is trusted by the most recent policy\u0027s set of root keys), thereby rolling back gittuf\u0027s policy to the attacker\u0027s chosen state.\n\nNote that the attacker cannot roll back the policy to one that would no longer be trusted by the most recent policy\u0027s root keys. As an example, say that Policy A\u0027s root keys were for Alice and Bob with a threshold of two, and then Policy B replaced Bob with Carol, with a threshold of two required. An attacker would not be able to roll back the policy to policy A, because it was signed by Alice and Bob, not Alice and Carol.\n\nIf you host your repository on a forge such as GitHub, GitLab, Bitbucket, etc., and only certain people are allowed to push to the RSL (e.g. only maintainers of your project have push access to the repository, and all other contributions must be done via pull request), then only those users with push access can perform the attack, or the forge itself.\n\n## Fix\n\ngittuf version v0.14.0 introduces a monotonically increasing number to all policy metadata (not to be confused with the metadata version, which dictates the features supported by the metadata). This number is incremented whenever a gittuf client of version v0.14.0 or greater updates the metadata or invokes a patch command to add this field.\n\nDuring policy verification, gittuf compares the monotonically increasing number of the new policy it encounters in the RSL to the current policy. If any file in the policy (e.g. root of trust, primary policy file, or delegated policy file) has this number, gittuf will check that it increases by one any time the respective file is changed.\n\n## Resolution\n\n### Upgrade gittuf and Apply Metadata Patch\n\ngittuf strongly recommends users upgrade to the latest version to remediate this vulnerability. Specifically, gittuf version v0.14.0 (and above) are patched with respect to this vulnerability. All users who use gittuf to verify the repository or update its policy metadata must upgrade to prevent this attack.\n\nAfter a consuming application applies the upgrade, a root of trust user or policy administrator must run:\n\n```\ngittuf trust increment-version\n```\n\nor:\n```\ngittuf policy increment-version\n```\n\nto add the monotonically increasing number field to the metadata (see [Fix](#fix) above).\n\n### Check for Rollback Attack Attempts\n\nBecause this attack requires the attacker to add an entry to the RSL, and because gittuf stores the RSL inside the repository, this attack cannot be performed without leaving evidence behind (in this case, the malicious RSL entry). To check for whether this attack was performed on your repository, run:\n\n```\ngittuf rsl log --ref refs/gittuf/policy\n```\n\nAll RSL entries that record new policy states for gittuf should be displayed. There should be one RSL entry every time a legitimate, new policy was applied. Should users find an RSL entry which points to an older policy state, their repository has been compromised.\n\n## Credits\n\ngittuf thanks Andrew Nesbitt (@andrew) for finding and responsibly disclosing this vulnerability.",
  "id": "GHSA-vxvc-cg7j-rwqj",
  "modified": "2026-05-14T20:54:36Z",
  "published": "2026-05-07T03:34:13Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/gittuf/gittuf/security/advisories/GHSA-vxvc-cg7j-rwqj"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44544"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gittuf/gittuf/commit/dd76efa505f9137a4a9a625c5ac67b333365a1b8"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/gittuf/gittuf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "gittuf\u0027s policy can be rolled back to prior valid versions"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-44544 (GCVE-0-2026-44544)

FKIE_CVE-2026-44544

GHSA-VXVC-CG7J-RWQJ

Summary

Impact

Fix

Resolution

Upgrade gittuf and Apply Metadata Patch

Check for Rollback Attack Attempts

Credits

Tags

Sightings

Nomenclature