AIKIDO-2026-897613
agent-manifest is vulnerable to Improper Verification of Cryptographic Signature
65
Medium Risk
This Affects:
agent-manifestTL;DR
The integrated verify_manifest path with human-in-the-loop enforcement enabled does not cryptographically validate the approval signature binding. It omits the standalone approval-verification step, so an approval signature issued for one manifest is accepted for a different manifest. Signed approvals can be replayed across manifests to satisfy human-in-the-loop enforcement that should reject them. The fix routes the integrated path through the binding approval-signature validation used by the standalone API.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you rely on the integrated verify path with human-in-the-loop enforcement enabled.
Background info
agent-manifest is vulnerable to Improper Verification of Cryptographic Signature in versions 0.0.1 - 0.11.0.
How to fix this
Upgrade the agent-manifest library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.