CVE-2026-49478

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a malicious or compromised issuer to perform blind SSRF, substitute and cache malicious JWKS keys, or disclose ServiceAccount tokens to external hosts. Version 1.8.6 blocks cross-host redirects, restricts token injection, and restricts local token loading. No known workarounds are available.

CVSS v3 8.7 HIGH

8.7^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.8

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/sigstore/fulcio/commit/378c654f48c3bafdced04ead7010aab2cb4c6ca1
https://github.com/sigstore/fulcio/pull/2354
https://github.com/sigstore/fulcio/releases/tag/v1.8.6
https://github.com/sigstore/fulcio/security/advisories/GHSA-f5mr-q85p-6hh6

Configurations

No configuration.

History

23 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) Fulcio es una autoridad de certificación para emitir certificados de firma de código para una identidad de OpenID Connect (OIDC). Las versiones hasta la 1.8.5 siguen incorrectamente las redirecciones entre hosts y adjuntan tokens de Kubernetes ServiceAccount durante el descubrimiento de OIDC, lo que permite a un emisor malicioso o comprometido realizar SSRF ciego, sustituir y almacenar en caché claves JWKS maliciosas, o divulgar tokens de ServiceAccount a hosts externos. La versión 1.8.6 bloquea las redirecciones entre hosts, restringe la inyección de tokens y restringe la carga local de tokens. No se conocen soluciones alternativas disponibles.

Information

Published : 2026-08-13 13:19

Updated : 2026-10-24 16:10

NVD link : CVE-2026-49478

Mitre link : CVE-2026-49478

CVE.ORG link : CVE-2026-49478

JSON object : View

Products Affected

No product.

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-49478", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49478", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-15T03:14:38.396830Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "sigstore", "product": "fulcio", "versions": [{"status": "affected", "version": "< 1.8.6"}]}]}], "published": "2026-08-13T13:19:09.790", "references": [{"url": "https://github.com/sigstore/fulcio/commit/378c654f48c3bafdced04ead7010aab2cb4c6ca1", "source": "security-advisories@github.com"}, {"url": "https://github.com/sigstore/fulcio/pull/2354", "source": "security-advisories@github.com"}, {"url": "https://github.com/sigstore/fulcio/releases/tag/v1.8.6", "source": "security-advisories@github.com"}, {"url": "https://github.com/sigstore/fulcio/security/advisories/GHSA-f5mr-q85p-6hh6", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a malicious or compromised issuer to perform blind SSRF, substitute and cache malicious JWKS keys, or disclose ServiceAccount tokens to external hosts. Version 1.8.6 blocks cross-host redirects, restricts token injection, and restricts local token loading. No known workarounds are available."}, {"lang": "es", "value": "Fulcio es una autoridad de certificaci\u00f3n para emitir certificados de firma de c\u00f3digo para una identidad de OpenID Connect (OIDC). Las versiones hasta la 1.8.5 siguen incorrectamente las redirecciones entre hosts y adjuntan tokens de Kubernetes ServiceAccount durante el descubrimiento de OIDC, lo que permite a un emisor malicioso o comprometido realizar SSRF ciego, sustituir y almacenar en cach\u00e9 claves JWKS maliciosas, o divulgar tokens de ServiceAccount a hosts externos. La versi\u00f3n 1.8.6 bloquea las redirecciones entre hosts, restringe la inyecci\u00f3n de tokens y restringe la carga local de tokens. No se conocen soluciones alternativas disponibles."}], "lastModified": "2026-10-24T16:10:00.153", "sourceIdentifier": "security-advisories@github.com"}