Listen to this Post
Several of AIIR’s verification and policy paths could return a success or “verified” result without actually enforcing the control they represent — they could fail open rather than fail closed. For a tool whose purpose is trustworthy verification, a consumer relying on these gates may have treated unverified or non‑conforming input as verified. The vulnerabilities were found during an internal adversarial hardening review of AIIR (not a third‑party audit). All paths are fixed in version 1.7.0.
Four distinct paths are affected. First, a `require_signing` policy gate could be satisfied by a forgeable or empty field, so an unsigned or forged‑bundle receipt could pass a “signing required” check without a valid signature. Second, a CI verification path could report success regardless of the underlying verification result. Third, a release‑verification gate could advertise policy limits it did not actually enforce. Fourth, a signature‑verification path could be silently skipped for certain input categories, exiting success without verifying.
Exploitation requires reliance on the affected gate; it does not forge valid signatures, nor does it compromise content‑addressing or correctly‑signed receipts. A consumer relying on these gates (e.g. require_signing, release/policy verification, or the CI check) to block unsigned, forged, or non‑conforming receipts could have received a false “verified”/”pass” result.
Patches are fixed in 1.7.0. Every affected path now fails closed, each with a regression test. Users should upgrade to aiir >= 1.7.0. There are no workarounds for earlier versions other than upgrading. Full cryptographic Sigstore verification (pip install aiir
</code>, `--verify-signature` with <code>--signer-identity</code>/<code>--signer-issuer</code>) provides defense in depth. This advisory covers code present in released versions (<code>< 1.7.0</code>). An unreleased agent‑receipt feature had pre‑release forgery findings fixed before it shipped — those were never in a released version and are out of scope. <h2 style="color: blue;">DailyCVE Form:</h2> Platform: AIIR (AI Integrity Receipts) Version: < 1.7.0 Vulnerability: Fail‑open verification bypass Severity: Moderate Date: 2026‑08‑28 <h2 style="color: blue;">Prediction: Patch already released (1.7.0)</h2> <h2 style="color: blue;">What Undercode Say:</h2> <h2 style="color: blue;">Check your current AIIR version:</h2> [bash] aiir --version
Verify a receipt with full Sigstore cryptographic verification (defense in depth):
pip install aiir[bash] aiir --verify .aiir/receipts --verify-signature --signer-identity <expected-identity> --signer-issuer <expected-issuer>
Verify the published release evidence for AIIR 1.7.0:
python scripts/verify-release-evidence.py 1.7.0
Run the regression test suite to confirm all fail‑closed paths are enforced:
pytest tests/ -v -k "verification or policy"
Exploit: (Educational Purposes!)
An attacker could craft an unsigned or forged bundle and send it to a consumer that relies on the `require_signing` gate. Because the gate could be satisfied by a forgeable/empty field, the bundle would pass the "signing required" check without a valid signature. Similarly, an attacker could supply input that triggers the CI verification path to report success regardless of the actual verification result, or supply input that causes the signature‑verification path to be silently skipped. In all cases, the consumer would treat unverified or non‑conforming input as verified. These flaws do not forge valid signatures or compromise correctly‑signed receipts.
Protection:
Upgrade to AIIR version 1.7.0 or later immediately. Every affected path now fails closed, with a regression test for each. If upgrading is not immediately possible, enable full cryptographic Sigstore verification with `--verify-signature` and proper signer identity/issuer checks. Avoid relying solely on the affected gates (require_signing, release/policy verification, or CI check) without additional cryptographic validation.
Impact:
A consumer relying on these gates to block unsigned, forged, or non‑conforming receipts could have received a false "verified"/"pass" result. This could lead to trust in unverified or non‑conforming AI integrity receipts, undermining the purpose of AIIR as a trustworthy verification tool. Exploitation does not forge valid signatures or compromise content‑addressing or correctly‑signed receipts. The impact is limited to consumers that depend on the affected gates without additional cryptographic checks.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
