Description
Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a malicious or compromised issuer to perform blind SSRF, substitute and cache malicious JWKS keys, or disclose ServiceAccount tokens to external hosts. Version 1.8.6 blocks cross-host redirects, restricts token injection, and restricts local token loading. No known workarounds are available.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| sigstore | fulcio | < 1.8.6 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | golang-github-sigstore-fulcio | 1.8.7-1 | — |
| Debian 13 | golang-github-sigstore-fulcio | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | golang-github-sigstore-fulcio | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | runfinch-finch | 1.17.2-1.amzn2023.0.3 | ALAS2023-2026-2023 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | aactl | 0.4.12-r58 | — |
| Wolfi rolling | buildah | 1.44.0-r8 | — |
| Wolfi rolling | falco-no-driver | 0.45.0-r0 | — |
| Wolfi rolling | falcoctl | 0.13.0-r9 | — |
| Wolfi rolling | flux-source-controller | 1.9.1-r1 | — |
| Wolfi rolling | gitsign +1 | 0.16.1-r3 | — |
| Wolfi rolling | kots | 1.130.6-r1 | — |
| Wolfi rolling | kubescape | 4.0.10-r2 | — |
| Wolfi rolling | kyverno-1.17 | 1.17.2-r35 | — |
| Wolfi rolling | kyverno-1.18 +5 | 1.18.1-r9 | — |
| Wolfi rolling | kyverno-cli-1.17 +4 | 1.17.2-r15 | — |
| Wolfi rolling | kyverno-notation-aws | 1.1-r63 | — |
| Wolfi rolling | podman | 6.0.0-r4 | — |
| Wolfi rolling | ratify | 1.4.0-r37 | — |
| Wolfi rolling | ratify-licensechecker-compat | 1.4.5-r4 | — |
| Wolfi rolling | skopeo | 1.23.0-r2 | — |
| Wolfi rolling | slsa-verifier | 2.7.1-r25 | — |
| Wolfi rolling | tekton-chains | 0.27.1-r4 | — |
| Wolfi rolling | undock | 0.14.0-r1 | — |
| Wolfi rolling | witness | 0.11.0-r9 | — |
| Wolfi rolling | zarf | 0.80.0-r2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/sigstore/fulcio | < 1.8.6 | 1.8.6 | GHSA-f5mr-q85p-6hh6 |
Advisories 2
- ALAS2023-2026-2023 Important: runfinch-finch security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Aug 4, 2026
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026