Skip to content
OpenAdvisories

Package · Go

github.com/sigstore/fulcio

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • High 8.7
    CVE-2026-49478

    Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage

    Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a maliciou…

    sigstore fulcio golang-github-sigstore-fulcio github.com/sigstore/fulcio Debian Ubuntu Go
  • Medium 5.8
    CVE-2026-22772

    Fulcio vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass

    Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.5, Fulcio's metaRegex() function uses unanchored regex, allowing attackers to bypass MetaIssuer URL validation and trigger SSRF to arbi…

    sigstore fulcio github.com/sigstore/fulcio golang-github-sigstore-fulcio Debian Ubuntu Go
  • High 7.5
    CVE-2025-66506

    Fulcio allocates excessive memory during token parsing

    Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.3, function identity.extractIssuerURL splits (via a call to strings.Split) its argument (which is untrusted data) on period…

    sigstore fulcio golang-github-sigstore-fulcio github.com/sigstore/fulcio Debian Ubuntu Go