PT-2026-4298 · Rekor · Rekor

1Seal · Published 2026-01-22 · Updated 2026-05-18 · CVE-2026-24117

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Rekor versions 1.4.3 and below

Description Rekor is a software supply chain transparency log. A Server-Side Request Forgery (SSRF) exists in versions 1.4.3 and below due to the /api/v1/index/retrieve endpoint supporting retrieval of a public key via a user-provided URL. The SSRF is limited to GET requests and does not allow for state modification or data exfiltration. An attacker could potentially probe an internal network through Blind SSRF.

Recommendations Disable the search endpoint with --enable retrieve api=false.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

AZL-76446

AZL-76542

AZL-76547

AZL-76608

CLEANSTART-2026-GK29346

CLEANSTART-2026-HF07497

CLEANSTART-2026-WB12909

CLEANSTART-2026-WN01990

CVE-2026-24117

GHSA-4C4X-JM2X-PF9J

GO-2026-4355

OPENSUSE-SU-2026:10127-1

SUSE-SU-2026:0403-1

Affected Products

Rekor

References · 227

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24117.json · Exploit
• https://github.com/sigstore/rekor/security/advisories/GHSA-4c4x-jm2x-pf9j · Vendor Advisory
• https://github.com/sigstore/rekor/commit/60ef2bceba192c5bf9327d003bceea8bf1f8275f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-1229 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-GK29346 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27139 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-27141 · Security Note
• https://osv.dev/vulnerability/GHSA-4c4x-jm2x-pf9j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26958 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-HF07497 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-76542 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4355 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22703 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23991 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-32282 · Security Note