CVE-2026-49478 – SSRF / Token Leakage / Cache Poisoning – Sigstore Fulcio < 1.8.6

Summary

CVE-2026-49478 is a high-severity (CVSS 8.7) vulnerability in Sigstore Fulcio, the certificate authority used in the Sigstore keyless-signing ecosystem, caused by improper handling of HTTP redirects during OIDC discovery. All versions prior to 1.8.6 follow cross-host redirects while attaching a Kubernetes ServiceAccount token, which can be abused to trigger blind Server-Side Request Forgery (SSRF), poison Fulcio’s OIDC verifier/JWKS cache with attacker-controlled keys, and leak in-cluster ServiceAccount tokens to external hosts. The issue is fixed in Fulcio v1.8.6.

Technical details

• Root cause: Fulcio’s OIDC discovery HTTP client fetches metadata from configured issuers’ /.well-known/openid-configuration endpoints and, prior to the fix, followed HTTP redirects to arbitrary hosts by default, with no restriction limiting redirects to the original host.
• Trigger conditions: A configured or compromised OIDC issuer (or a wildcard/meta-issuer configuration, e.g. matching external EKS/GKE-style endpoints) returns an HTTP redirect during discovery, or supplies a malicious jwks_uri value pointing to an attacker-controlled host.
• SSRF impact: Cross-host redirects allow an attacker-controlled or compromised issuer to redirect Fulcio’s outbound discovery requests to internal-only network resources (blind SSRF), since Fulcio does not return response bodies to the caller.
• Cache poisoning impact: By redirecting discovery to a malicious jwks_uri, an attacker can get Fulcio to initialize and cache a verifier using attacker-supplied JWKS keys, allowing subsequently attacker-controlled tokens/signatures to be accepted as valid.
• Token leakage impact: Fulcio mounts an in-cluster Kubernetes ServiceAccount token to authenticate discovery requests to the local Kubernetes API server (https://kubernetes.default.svc). Because the HTTP transport attached this token globally rather than restricting it to the intended host, a cross-host redirect or an externally-pointed jwks_uri (including via wildcard Kubernetes-type meta-issuer configurations) could cause the sensitive in-cluster token to be sent to a third-party/attacker-controlled host.
• Attack vector: Network (AV:N); requires an attacker to control or compromise a configured OIDC issuer’s discovery response, or exploit a wildcard meta-issuer configuration — no authentication or user interaction from a victim is required to trigger the flow.

Affected software

• sigstore/fulcio — all versions prior to 1.8.6
• Fixed in 1.8.6 and later

Severity

• CVSS v3.1 Base Score: 8.7 (High)
• Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Mitigation and recommended actions

• Immediate: Upgrade Fulcio to v1.8.6 or later, which rejects cross-host redirects during OIDC discovery via a custom redirect policy, restricts ServiceAccount token attachment to exact host matches, and limits local token loading to the private Kubernetes API server endpoint only.
• If immediate patching is not possible:
  • Audit configured OIDC issuers and meta-issuer (wildcard) definitions to ensure no untrusted or overly broad issuer patterns are permitted.
  • Restrict outbound network access from Fulcio deployments so discovery requests cannot reach unintended internal hosts (network-level egress controls as defense-in-depth).
  • Monitor Fulcio logs for unexpected redirects or discovery requests to unfamiliar hosts.
  • No official workaround exists in place of upgrading; the vendor advisory states upgrading is required to fully remediate.

References

• CVE-2026-49478 at NIST NVD
• GitHub Security Advisory GHSA-f5mr-q85p-6hh6 (sigstore/fulcio)
• CVE Record (CVEProject/cvelistV5)