PT-2026-54443 · Fulcio · Fulcio
Published
2026-06-30
·
Updated
2026-06-30
·
CVE-2026-49478
CVSS v3.1
8.7
High
| Vector | AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Fulcio versions prior to 1.8.6
Description
Three security issues were identified in the OIDC Discovery client. First, a blind Server-Side Request Forgery (SSRF) occurs because the HTTP client used to fetch OIDC discovery metadata from the
/.well-known/openid-configuration endpoint followed cross-host redirects by default, allowing requests to be sent to internal-only systems. Second, this behavior enables JWKS substitution and cache poisoning, where an attacker can manipulate the discovery flow to return a malicious jwks uri and poison the verifier cache with attacker-controlled verification keys. Third, Kubernetes ServiceAccount tokens are leaked to third-party hosts when the transport attaches the token globally during redirects or when a wildcard MetaIssuer of type kubernetes matches an external endpoint while a local Kubernetes issuer is configured.Recommendations
Update to version 1.8.6.
Fix
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Fulcio