Bug 2499690 (CVE-2026-49478)
| Summary: | CVE-2026-49478 github.com/sigstore/fulcio: Fulcio: Server-Side Request Forgery and Kubernetes ServiceAccount token leakage | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | abarbaro, akoudelk, alizardo, anjoseph, anpicker, aprice, aruklets, cahl, cdrage, derez, dfreiber, dhanak, dkeler, doconnor, drosa, drow, dschmidt, dsimansk, dymurray, eborisov, ebourniv, eglynn, gbenhaim, gparvin, hasun, ibolton, jburrell, jcantril, jchui, jfula, jhe, jjoyce, jlanda, jmatthew, jmitchel, jmontleo, jowilson, jprabhak, jpretori, jsamir, jschluet, kaycoth, kbempah, kingland, kshier, ktsao, lball, lbragsta, lgallett, lgamliel, lhh, ljawale, manissin, mburns, mgarciac, mnovotny, msilmser, nboldt, ngough, niyer, nyancey, oaljalju, oezr, ometelka, pakotvan, pgaikwad, psrna, ptisnovs, rekumar, rhaigner, rhel-process-autobot, rjohnson, rojacob, rushinde, sakbas, sausingh, sbratsla, sbunciak, sdawley, simaishi, slucidi, solenoci, sseago, stcannon, sthirugn, suppawar, syedriko, teagle, thason, twaugh, tzivkovi, veshanka, vkumar, vvoronko, watson-tool-maintainers, wenshen, whayutin, wtam, xdharmai, yguenane |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in Fulcio's OpenID Connect (OIDC) Discovery client. This vulnerability allows a remote attacker to perform Server-Side Request Forgery (SSRF) by redirecting discovery requests to internal systems. Additionally, an attacker can manipulate the JSON Web Key Set (JWKS) Uniform Resource Identifier (URI) to poison the verifier cache with malicious keys, enabling the validation of attacker-controlled signatures. Furthermore, the flaw can lead to the leakage of Kubernetes ServiceAccount tokens to third-party hosts through cross-host redirects or misconfigured MetaIssuers, potentially exposing sensitive cluster credentials.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-07-13 14:40:31 UTC
|