VYPR
← All advisories
High severity8.7NVD Advisory· Published Aug 13, 2026· Updated Aug 15, 2026

CVE-2026-49478

CVE-2026-49478

Description

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a malicious or compromised issuer to perform blind SSRF, substitute and cache malicious JWKS keys, or disclose ServiceAccount tokens to external hosts. Version 1.8.6 blocks cross-host redirects, restricts token injection, and restricts local token loading. No known workarounds are available.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/sigstore/fulcioGo
< 1.8.61.8.6

Affected products

127

Patches

Vulnerability mechanics

References

5

News mentions

0

No linked articles in our index yet.