PT-2026-2303 · Fulcio · Fulcio

Morwn · Published 2026-01-12 · Updated 2026-05-18 · CVE-2026-22772

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Fulcio versions prior to 1.8.5

Description Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. The metaRegex() function uses unanchored regular expressions, potentially allowing attackers to bypass MetaIssuer URL validation and trigger Server-Side Request Forgery (SSRF) to internal services. The SSRF is limited to GET requests and does not allow data exfiltration, but could be used for blind SSRF probing of an internal network.

Recommendations Update to Fulcio version 1.8.5 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CLEANSTART-2026-BD19566

CLEANSTART-2026-EZ47382

CLEANSTART-2026-GK29346

CLEANSTART-2026-HF07497

CLEANSTART-2026-NS33477

CLEANSTART-2026-WB12909

CLEANSTART-2026-WN01990

CVE-2026-22772

GHSA-59JP-PJ84-45MR

GO-2026-4311

OPENSUSE-RU-2026:20161-1

OPENSUSE-SU-2026:10068-1

OPENSUSE-SU-2026:10230-1

OPENSUSE-SU-2026:10235-1

OPENSUSE-SU-2026:20386-1

SUSE-SU-2026:0292-1

SUSE-SU-2026:0592-1

SUSE-SU-2026:0777-1

SUSE-SU-2026:20904-1

Affected Products

Fulcio

References · 237

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22772.json · Exploit
• https://github.com/sigstore/fulcio/security/advisories/GHSA-59jp-pj84-45mr · Vendor Advisory
• https://github.com/sigstore/fulcio/commit/eaae2f2be56df9dea5f9b439ec81bedae4c0978d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-1229 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10068-1 · Vendor Advisory
• https://osv.dev/vulnerability/CLEANSTART-2026-GK29346 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27139 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-27141 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-26958 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-HF07497 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-22772 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22703 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:0777-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23991 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-32282 · Security Note