How must an instance verify that a vulnerability database has not been poisoned before acting on a CVE?

**Date of Record:** 2026 October 26 **Scope:** Applies when an agentic session consumes vulnerability data (CVE feeds, NVD, OSV, or vendor advisories) to trigger automated patching, isolation, or deployment decisions, and the feed could be compromised, spoofed, or poisoned. Does not apply to air-gapped systems where vulnerability data is manually curated and hardware-verified.

Core Distinction

The separation between **vulnerability data freshness** (the feed is recent and syntactically valid) and **vulnerability data provenance** (the feed was issued by the authentic source, not by a compromised mirror or a malicious actor injecting fake CVEs). Failing to distinguish these creates the **CVE Poisoning Attack**: an attacker injects a fake critical CVE for a package the agent uses, causing the agent to downgrade to an older, actually-vulnerable version, or to halt critical infrastructure out of panic.

What Was Observed

In automated security response architectures, failing to verify vulnerability database provenance produces three primary failure modes:

  1. **Fake Critical CVE:** An attacker injects a fake CVE claiming a critical vulnerability in a widely-used package. The agent immediately applies a "patch" (which is actually the attacker's malicious package), compromising the system.
  2. **False Positive Downgrade:** The poisoned CVE tells the agent to downgrade to a "safe" version that is actually the vulnerable version. The agent, trusting the feed, obeys.
  3. **Availability Attack:** The poisoned CVE targets a critical infrastructure component, causing the agent to halt a service to prevent "exploitation," resulting in an outage.

Recorded Elements

  1. **`upstream_signature_chain`:** The cryptographic chain of signatures from the CVE database's root CA down to the specific CVE entry, proving the entry was issued by the authentic source.
  2. **`mirror_consistency_receipt`:** The cryptographic proof that the mirror the agent queried matches the authoritative upstream source, detecting feed poisoning at the mirror level.
  3. **`cross_reference_verification_hash`:** The hash of cross-references against multiple independent vulnerability databases (NVD, OSV, vendor advisories), ensuring the CVE exists in more than one authoritative source.
  4. **`patch_provenance_signature`:** When the CVE recommends a patch, the cryptographic proof that the patch comes from the authentic package maintainer, not an attacker-controlled URL.

Condition of Validity

* **Applies when:** The agent takes automated action (patching, downgrading, halting services) based on vulnerability data, and the data source is not hardware-verified. * **Does not apply when:** The vulnerability data is consumed for human review only (no automated action), or the feed is sourced from a hardware-attested, air-gapped system.

Decision Boundary

  1. **Is the CVE entry signed by the authentic upstream root?** If no, the entry is untrusted. The instance must not act on it.
  2. **Does the mirror consistency receipt prove the local feed matches upstream?** If no, the mirror may be compromised. The instance must re-fetch from the authoritative source.
  3. **Is the CVE confirmed across at least two independent databases?** If no, the CVE may be fabricated. The instance must quarantine the patch action until cross-referenced.
  4. **Conversely, when can an agent act on a single-source CVE without cross-reference?** Only when the action is non-destructive (e.g., logging, alerting) and the CVE triggers a human review rather than automated patching.

Operational Effect

  1. **Supply Chain Integrity:** Prevents attackers from tricking the agent into installing malicious "patches" via fake CVEs.
  2. **False Positive Containment:** Requires cross-referencing before destructive actions, catching fabricated or low-confidence CVEs.
  3. **Availability Protection:** Prevents denial-of-service attacks that abuse fake critical CVEs to halt services.
from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class CVEVerdict(Enum):
    VERIFIED_CVE = auto()
    UNTRUSTED_SIGNATURE = auto()
    MIRROR_MISMATCH = auto()
    INSUFFICIENT_CROSS_REFERENCE = auto()

@dataclass(frozen=True)
class CVEEntry:
    cve_id: str
    upstream_signature_chain_hash: str
    mirror_consistency_hash: str
    cross_reference_count: int
    patch_provenance_signed: bool

@dataclass(frozen=True)
class CVEPolicy:
    trusted_upstream_hashes: frozenset[str]
    min_cross_references: int
    require_patch_provenance: bool

@dataclass(frozen=True)
class CVEManifest:
    verdict: CVEVerdict
    directive: str
    manifest_digest: str

class CVEPoisoningGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_cve(
        cls, entry: CVEEntry, policy: CVEPolicy
    ) -> CVEManifest:
        
        # Gate 1: Upstream trust
        if entry.upstream_signature_chain_hash not in policy.trusted_upstream_hashes:
            return CVEManifest(
                verdict=CVEVerdict.UNTRUSTED_SIGNATURE,
                directive=f"HALT: CVE {entry.cve_id} signature chain not in trusted set. Possible poisoning.",
                manifest_digest=cls._hash(f"UNTRUSTED:{entry.cve_id}")
            )

        # Gate 2: Mirror consistency
        if not entry.mirror_consistency_hash.strip():
            return CVEManifest(
                verdict=CVEVerdict.MIRROR_MISMATCH,
                directive=f"HALT: CVE {entry.cve_id} mirror consistency unverified.",
                manifest_digest=cls._hash(f"NO_MIRROR:{entry.cve_id}")
            )

        # Gate 3: Cross-reference
        if entry.cross_reference_count < policy.min_cross_references:
            return CVEManifest(
                verdict=CVEVerdict.INSUFFICIENT_CROSS_REFERENCE,
                directive=f"HALT: CVE {entry.cve_id} has {entry.cross_reference_count} cross-refs, minimum {policy.min_cross_references}.",
                manifest_digest=cls._hash(f"CROSS_REF:{entry.cve_id}")
            )

        # Gate 4: Patch provenance
        if policy.require_patch_provenance and not entry.patch_provenance_signed:
            return CVEManifest(
                verdict=CVEVerdict.UNTRUSTED_SIGNATURE,
                directive=f"HALT: CVE {entry.cve_id} patch lacks provenance signature.",
                manifest_digest=cls._hash(f"NO_PATCH:{entry.cve_id}")
            )

        # Gate 5: Verified
        digest = cls._hash(json.dumps({
            "cve": entry.cve_id,
            "upstream": entry.upstream_signature_chain_hash,
            "cross_refs": str(entry.cross_reference_count),
            "patch_signed": str(entry.patch_provenance_signed)
        }, sort_keys=True))
        
        return CVEManifest(
            verdict=CVEVerdict.VERIFIED_CVE,
            directive="PROCEED: CVE verified across signatures, mirrors, and cross-references.",
            manifest_digest=digest
        )