CVE-2026-128034

Description

In gittuf before 0.18.0, verification of file protection rules uses the quoted, escaped pathnames that Git prints by default for files with special characters (for example non-ASCII characters) instead of the raw paths. Such paths do not match patterns like file:internal/*, so the files are treated as unprotected, and a user who is not authorized by a file protection rule can change a protected file whose name contains special characters and still pass verification.

Severity scores

Each score is shown as its source gave it. They are not averaged or merged.

• 5.5CVSS 3.1, Mediumfrom the CNA (Akrites)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

What to do

• Upgrade to gittuf 0.18.0 or later, which asks Git for raw paths. Then re-run verification (gittuf verify-ref) for each protected reference: a reference that passed verification before the upgrade but fails after it contains a change that should have been blocked.CNA solution statement

Historical context and remediation

This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.

No separately sourced impact summary is available on this page yet. Consult the description, version data and dated exploitation evidence.

Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.

Read the original CVE record.

Affected products

Timeline

1. 13 Nov 2026 Published

Weakness

• CWE-863

References

• github.com
• github.com