Skip to content
OpenAdvisories

Package · Go

github.com/sigstore/fulcio

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.7
    CVE-2026-49478

    Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage

    Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a maliciou…

    sigstore fulcio golang-github-sigstore-fulcio github.com/sigstore/fulcio Debian Ubuntu Go
  • High 7.5
    CVE-2025-66506

    Fulcio allocates excessive memory during token parsing

    Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.3, function identity.extractIssuerURL splits (via a call to strings.Split) its argument (which is untrusted data) on period…

    sigstore fulcio github.com/sigstore/fulcio golang-github-sigstore-fulcio Debian Ubuntu Go