What’s Vulnerable › Products

sigstore fulcio vulnerabilities

3 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 3 published in the last 12 months.

Check whether your sigstore fulcio version is affected

Latest sigstore fulcio vulnerabilities

• CVE-2026-49478 — Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage (CVSS 8.7)
• CVE-2026-22772 — Fulcio vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass (CVSS 5.3)
• CVE-2025-66506 — Fulcio allocates excessive memory during token parsing (CVSS 7.5)