Moderate severity6.5NVD Advisory· Published Jun 30, 2026

github.com/sigstore/fulcio: Fulcio: Server-Side Request Forgery and Kubernetes ServiceAccount token leakage

CVE-2026-49478

Description

Affected products

125

Sigstore/Fulciollm-fuzzy
osv-coords124 versions
pkg:apk/chainguard/aactl pkg:apk/chainguard/buildah pkg:apk/chainguard/buildah-fips pkg:apk/chainguard/chainctl pkg:apk/chainguard/chainctl-fips pkg:apk/chainguard/falcoctl pkg:apk/chainguard/falcoctl-fips pkg:apk/chainguard/flux-source-controller pkg:apk/chainguard/flux-source-controller-fips pkg:apk/chainguard/gitsign pkg:apk/chainguard/gitsign-credential-cache pkg:apk/chainguard/kots pkg:apk/chainguard/kubescape pkg:apk/chainguard/kubescape-server pkg:apk/chainguard/kubescape-server-downloader pkg:apk/chainguard/kubescape-server-fips pkg:apk/chainguard/kubescape-server-fips-downloader pkg:apk/chainguard/kyverno-1.15 pkg:apk/chainguard/kyverno-1.16 pkg:apk/chainguard/kyverno-1.17 pkg:apk/chainguard/kyverno-1.18 pkg:apk/chainguard/kyverno-background-controller-1.15 pkg:apk/chainguard/kyverno-background-controller-1.16 pkg:apk/chainguard/kyverno-background-controller-1.17 pkg:apk/chainguard/kyverno-background-controller-1.18 pkg:apk/chainguard/kyverno-background-controller-fips-1.15 pkg:apk/chainguard/kyverno-background-controller-fips-1.16 pkg:apk/chainguard/kyverno-background-controller-fips-1.17 pkg:apk/chainguard/kyverno-background-controller-fips-1.18 pkg:apk/chainguard/kyverno-cleanup-controller-1.15 pkg:apk/chainguard/kyverno-cleanup-controller-1.16 pkg:apk/chainguard/kyverno-cleanup-controller-1.17 pkg:apk/chainguard/kyverno-cleanup-controller-1.18 pkg:apk/chainguard/kyverno-cleanup-controller-fips-1.15 pkg:apk/chainguard/kyverno-cleanup-controller-fips-1.16 pkg:apk/chainguard/kyverno-cleanup-controller-fips-1.17 pkg:apk/chainguard/kyverno-cleanup-controller-fips-1.18 pkg:apk/chainguard/kyverno-cli-1.15 pkg:apk/chainguard/kyverno-cli-1.16 pkg:apk/chainguard/kyverno-cli-1.17 pkg:apk/chainguard/kyverno-cli-1.18 pkg:apk/chainguard/kyverno-cli-fips-1.15 pkg:apk/chainguard/kyverno-cli-fips-1.16 pkg:apk/chainguard/kyverno-cli-fips-1.17 pkg:apk/chainguard/kyverno-cli-fips-1.18 pkg:apk/chainguard/kyverno-fips-1.15 pkg:apk/chainguard/kyverno-fips-1.16 pkg:apk/chainguard/kyverno-fips-1.17 pkg:apk/chainguard/kyverno-fips-1.18 pkg:apk/chainguard/kyverno-init-container-1.15 pkg:apk/chainguard/kyverno-init-container-1.16 pkg:apk/chainguard/kyverno-init-container-1.17 pkg:apk/chainguard/kyverno-init-container-1.18 pkg:apk/chainguard/kyverno-init-container-fips-1.15 pkg:apk/chainguard/kyverno-init-container-fips-1.16 pkg:apk/chainguard/kyverno-init-container-fips-1.17 pkg:apk/chainguard/kyverno-init-container-fips-1.18 pkg:apk/chainguard/kyverno-notation-aws pkg:apk/chainguard/kyverno-notation-aws-fips pkg:apk/chainguard/kyverno-reports-controller-1.15 pkg:apk/chainguard/kyverno-reports-controller-1.16 pkg:apk/chainguard/kyverno-reports-controller-1.17 pkg:apk/chainguard/kyverno-reports-controller-1.18 pkg:apk/chainguard/kyverno-reports-controller-fips-1.15 pkg:apk/chainguard/kyverno-reports-controller-fips-1.16 pkg:apk/chainguard/kyverno-reports-controller-fips-1.17 pkg:apk/chainguard/kyverno-reports-controller-fips-1.18 pkg:apk/chainguard/podman pkg:apk/chainguard/podman-fips pkg:apk/chainguard/portieris-fips pkg:apk/chainguard/prometheus-podman-exporter pkg:apk/chainguard/prometheus-podman-exporter-fips pkg:apk/chainguard/ratify pkg:apk/chainguard/ratify-fips pkg:apk/chainguard/skopeo pkg:apk/chainguard/skopeo-fips pkg:apk/chainguard/slsa-verifier pkg:apk/chainguard/tekton-chains pkg:apk/chainguard/tekton-chains-fips pkg:apk/chainguard/undock pkg:apk/chainguard/witness pkg:apk/chainguard/zarf pkg:apk/chainguard/zarf-fips pkg:apk/wolfi/aactl pkg:apk/wolfi/buildah pkg:apk/wolfi/falcoctl pkg:apk/wolfi/flux-source-controller pkg:apk/wolfi/gitsign pkg:apk/wolfi/gitsign-credential-cache pkg:apk/wolfi/kots pkg:apk/wolfi/kubescape pkg:apk/wolfi/kyverno-1.15 pkg:apk/wolfi/kyverno-1.16 pkg:apk/wolfi/kyverno-1.17 pkg:apk/wolfi/kyverno-1.18 pkg:apk/wolfi/kyverno-background-controller-1.15 pkg:apk/wolfi/kyverno-background-controller-1.16 pkg:apk/wolfi/kyverno-background-controller-1.17 pkg:apk/wolfi/kyverno-background-controller-1.18 pkg:apk/wolfi/kyverno-cleanup-controller-1.15 pkg:apk/wolfi/kyverno-cleanup-controller-1.16 pkg:apk/wolfi/kyverno-cleanup-controller-1.17 pkg:apk/wolfi/kyverno-cleanup-controller-1.18 pkg:apk/wolfi/kyverno-cli-1.15 pkg:apk/wolfi/kyverno-cli-1.16 pkg:apk/wolfi/kyverno-cli-1.17 pkg:apk/wolfi/kyverno-cli-1.18 pkg:apk/wolfi/kyverno-init-container-1.15 pkg:apk/wolfi/kyverno-init-container-1.16 pkg:apk/wolfi/kyverno-init-container-1.17 pkg:apk/wolfi/kyverno-init-container-1.18 pkg:apk/wolfi/kyverno-notation-aws pkg:apk/wolfi/kyverno-reports-controller-1.15 pkg:apk/wolfi/kyverno-reports-controller-1.16 pkg:apk/wolfi/kyverno-reports-controller-1.17 pkg:apk/wolfi/kyverno-reports-controller-1.18 pkg:apk/wolfi/podman pkg:apk/wolfi/ratify pkg:apk/wolfi/skopeo pkg:apk/wolfi/slsa-verifier pkg:apk/wolfi/tekton-chains pkg:apk/wolfi/undock pkg:apk/wolfi/witness pkg:apk/wolfi/zarf
< 0.4.12-r58+ 123 more
- (no CPE)range: < 0.4.12-r58
- (no CPE)range: < 1.44.0-r8
- (no CPE)range: < 1.44.0-r5
- (no CPE)range: < 0.2.300-r1
- (no CPE)range: < 0.2.300-r1
- (no CPE)range: < 0.13.0-r9
- (no CPE)range: < 0.13.0-r7
- (no CPE)range: < 1.9.1-r1
- (no CPE)range: < 1.9.1-r1
- (no CPE)range: < 0.16.1-r3
- (no CPE)range: < 0.16.1-r3
- (no CPE)range: < 1.130.6-r1
- (no CPE)range: < 4.0.10-r2
- (no CPE)range: < 4.0.10-r2
- (no CPE)range: < 4.0.10-r2
- (no CPE)range: < 4.0.10-r2
- (no CPE)range: < 4.0.10-r2
- (no CPE)range: < 1.15.3-r23
- (no CPE)range: < 1.16.4-r9
- (no CPE)range: < 1.17.2-r15
- (no CPE)range: < 1.18.1-r9
- (no CPE)range: < 1.15.3-r23
- (no CPE)range: < 1.16.4-r9
- (no CPE)range: < 1.17.2-r15
- (no CPE)range: < 1.18.1-r9
- (no CPE)range: < 1.15.20-r8
- (no CPE)range: < 1.16.4-r9
- (no CPE)range: < 1.17.2-r10
- (no CPE)range: < 1.18.2-r1
- (no CPE)range: < 1.15.3-r23
- (no CPE)range: < 1.16.4-r9
- (no CPE)range: < 1.17.2-r15
- (no CPE)range: < 1.18.1-r9
- (no CPE)range: < 1.15.20-r8
- (no CPE)range: < 1.16.4-r9
- (no CPE)range: < 1.17.2-r10
- (no CPE)range: < 1.18.2-r1
- (no CPE)range: < 1.15.3-r23
- (no CPE)range: < 1.16.4-r9
- (no CPE)range: < 1.17.2-r15
- (no CPE)range: < 1.18.1-r9
- (no CPE)range: < 1.15.20-r8
- (no CPE)range: < 1.16.4-r9
- (no CPE)range: < 1.17.2-r10
- (no CPE)range: < 1.18.2-r1
- (no CPE)range: < 1.15.20-r8
- (no CPE)range: < 1.16.4-r10
- (no CPE)range: < 1.17.2-r10
- (no CPE)range: < 1.18.2-r1
- (no CPE)range: < 1.15.3-r23
- (no CPE)range: < 1.16.4-r9
- (no CPE)range: < 1.17.2-r15
- (no CPE)range: < 1.18.1-r9
- (no CPE)range: < 1.15.20-r8
- (no CPE)range: < 1.16.4-r9
- (no CPE)range: < 1.17.2-r10
- (no CPE)range: < 1.18.2-r1
- (no CPE)range: < 1.1-r63
- (no CPE)range: < 1.1-r56
- (no CPE)range: < 1.15.3-r23
- (no CPE)range: < 1.16.4-r9
- (no CPE)range: < 1.17.2-r15
- (no CPE)range: < 1.18.1-r9
- (no CPE)range: < 1.15.20-r8
- (no CPE)range: < 1.16.4-r9
- (no CPE)range: < 1.17.2-r10
- (no CPE)range: < 1.18.2-r1
- (no CPE)range: < 6.0.0-r4
- (no CPE)range: < 6.0.0-r2
- (no CPE)range: < 0.14.2-r0
- (no CPE)range: < 1.21.2-r2
- (no CPE)range: < 1.21.2-r2
- (no CPE)range: < 1.4.0-r37
- (no CPE)range: < 1.4.0-r35
- (no CPE)range: < 1.23.0-r2
- (no CPE)range: < 1.23.0-r5
- (no CPE)range: < 2.7.1-r25
- (no CPE)range: < 0.27.1-r4
- (no CPE)range: < 0.27.1-r3
- (no CPE)range: < 0.14.0-r1
- (no CPE)range: < 0.11.0-r9
- (no CPE)range: < 0.80.0-r2
- (no CPE)range: < 0.80.0-r3
- (no CPE)range: < 0.4.12-r58
- (no CPE)range: < 1.44.0-r8
- (no CPE)range: < 0.13.0-r9
- (no CPE)range: < 1.9.1-r1
- (no CPE)range: < 0.16.1-r3
- (no CPE)range: < 0.16.1-r3
- (no CPE)range: < 1.130.6-r1
- (no CPE)range: < 4.0.10-r2
- (no CPE)range: < 1.15.3-r23
- (no CPE)range: < 1.16.4-r9
- (no CPE)range: < 1.17.2-r15
- (no CPE)range: < 1.18.1-r9
- (no CPE)range: < 1.15.3-r23
- (no CPE)range: < 1.16.4-r9
- (no CPE)range: < 1.17.2-r15
- (no CPE)range: < 1.18.1-r9
- (no CPE)range: < 1.15.3-r23
- (no CPE)range: < 1.16.4-r9
- (no CPE)range: < 1.17.2-r15
- (no CPE)range: < 1.18.1-r9
- (no CPE)range: < 1.15.3-r23
- (no CPE)range: < 1.16.4-r9
- (no CPE)range: < 1.17.2-r15
- (no CPE)range: < 1.18.1-r9
- (no CPE)range: < 1.15.3-r23
- (no CPE)range: < 1.16.4-r9
- (no CPE)range: < 1.17.2-r15
- (no CPE)range: < 1.18.1-r9
- (no CPE)range: < 1.1-r63
- (no CPE)range: < 1.15.3-r23
- (no CPE)range: < 1.16.4-r9
- (no CPE)range: < 1.17.2-r15
- (no CPE)range: < 1.18.1-r9
- (no CPE)range: < 6.0.0-r4
- (no CPE)range: < 1.4.0-r37
- (no CPE)range: < 1.23.0-r2
- (no CPE)range: < 2.7.1-r25
- (no CPE)range: < 0.27.1-r4
- (no CPE)range: < 0.14.0-r1
- (no CPE)range: < 0.11.0-r9
- (no CPE)range: < 0.80.0-r2

Patches

Vulnerability mechanics

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000