CVE-2026-49478
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Fulcio, a certificate authority for issuing code signing certificates for OIDC identities, versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a malicious or compromised issuer to perform blind SSRF, substitute and cache malicious JWKS keys, or disclose ServiceAccount tokens to external hosts.
Risk Assessment
Risk of ServiceAccount token disclosure, SSRF attacks, and JWKS key substitution, potentially leading to system integrity breaches and unauthorized access.
Recommendation
Update Fulcio to version 1.8.6 or later, which blocks cross-host redirects, restricts token injection, and restricts local token loading.
Original NVD description (English source)
Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a malicious or compromised issuer to perform blind SSRF, substitute and cache malicious JWKS keys, or disclose ServiceAccount tokens to external hosts. Version 1.8.6 blocks cross-host redirects, restricts token injection, and restricts local token loading. No known workarounds are available.