CVE-2026-128035
MEDIUM
NVD
CVSS Score
5.5
Severity
MEDIUM
Published
Nov 13, 2026
Vendor
unknown
Description
In gittuf 0.10.0 through 0.17.0, the verification workflow does not load policy updates that are propagated from an upstream (controller) repository and recorded in the reference state log after the first entry being verified. Only the propagated policy in effect at the start of verification is applied, so later controller changes to global rules, such as threshold requirements and force-push blocks, are ignored and changes that these rules should block pass verification.