What’s Vulnerable › Vulnerabilities

CVE-2026-22772: Fulcio vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-01-12 · updated 2026-06-17
• Weakness: CWE-918

Description

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.5, Fulcio's metaRegex() function uses unanchored regex, allowing attackers to bypass MetaIssuer URL validation and trigger SSRF to arbitrary internal services. Since the SSRF only can trigger GET requests, the request cannot mutate state. The response from the GET request is not returned to the caller so data exfiltration is not possible. A malicious actor could attempt to probe an internal network through Blind SSRF. This vulnerability is fixed in 1.8.5.

Affected products

• sigstore fulcio: before 1.8.5 — fixed in 1.8.5

How to fix

Upgrade to a fixed version: sigstore fulcio 1.8.5. Check the vendor advisory for mitigations.

References

• https://github.com/sigstore/fulcio/commit/eaae2f2be56df9dea5f9b439ec81bedae4c0978d
• https://github.com/sigstore/fulcio/security/advisories/GHSA-59jp-pj84-45mr

Get alerted when CVE-2026-22772 or the next vulnerability affects your stack