CVE-2026-49478

2 advisories.

Go/github.com/sigstore/fulcio CVE-2026-49478: high 8.7, EPSS 0.28%

Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage

Action: Upgrade github.com/sigstore/fulcio to 1.8.6 or later.

go get github.com/sigstore/fulcio@v1.8.6

Affected

introduced	fixed	last affected
0	1.8.6	-

Fixed versions

1.8.6

Sources

CVE-2026-49478 · published 2026-06-30T18:38:45Z · modified 2026-09-10T03:50:49.276908685Z · JSON

Go/github.com/sigstore/fulcio CVE-2026-49478: unknown, EPSS 0.28%

Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage in github.com/sigstore/fulcio

Action: Upgrade github.com/sigstore/fulcio to 1.8.6 or later.

go get github.com/sigstore/fulcio@v1.8.6

Affected

introduced	fixed	last affected
0	1.8.6	-

Fixed versions

1.8.6

Sources

CVE-2026-49478 · published 2026-07-07T15:26:32Z · modified 2026-07-10T18:29:34.740186874Z · JSON