Cloudanix VulnDB

CVE-2026-22772

Medium · 5.8

CVSS

5.8

EPSS

0.2%

Published

Jan 12, 2026

CISA due date

—

The record

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.5, Fulcio's metaRegex() function uses unanchored regex, allowing attackers to bypass MetaIssuer URL validation and trigger SSRF to arbitrary internal services. Since the SSRF only can trigger GET requests, the request cannot mutate state. The response from the GET request is not returned to the caller so data exfiltration is not possible. A malicious actor could attempt to probe an internal network through Blind SSRF. This vulnerability is fixed in 1.8.5.

Affected packages

Ecosystem Package Introduced Fixed
Go github.com/sigstore/fulcio 0 1.8.5
Chainguard aactl 0 0.4.12-r41
Chainguard chainctl 0 0.2.197-r0
Chainguard cosign 0 3.0.4-r1
Chainguard falco-no-driver 0 0.43.0-r1
Chainguard falcoctl 0 0.12.0-r0
Chainguard falcoctl-fips 0 0.12.1-r0
Chainguard flux-source-controller-fips 0 1.7.4-r5
Chainguard gitsign 0 0.14.0-r0
Chainguard gitsign-credential-cache 0 0.14.0-r0
Chainguard image-factory 0 0.9.0-r4
Chainguard kots 0 1.129.3-r0
Chainguard kubescape 0 3.0.48-r0
Chainguard kyverno-policy-reporter-plugins-kyverno-fips 0 0.5.3-r6
Chainguard podman-fips 0 5.7.1-r3
Chainguard sigstore-scaffolding-ctlog-createctconfig 0 0.7.31-r4
Chainguard sigstore-scaffolding-ctlog-managectroots 0 0.7.31-r4
Chainguard sigstore-scaffolding-ctlog-verifyfulcio 0 0.7.31-r4
Chainguard sigstore-scaffolding-fips-ctlog-createctconfig 0 0.7.31-r5
Chainguard sigstore-scaffolding-fips-ctlog-managectroots 0 0.7.31-r5
Chainguard sigstore-scaffolding-fips-ctlog-verifyfulcio 0 0.7.31-r5
Chainguard skopeo 0 1.21.0-r2
Chainguard slsa-verifier 0 2.7.1-r6
Chainguard tekton-chains 0 0.26.0-r6
Chainguard vexctl 0 0.4.1-r5
Chainguard witness 0 0.10.2-r0
Chainguard zarf 0 0.70.1-r0
SUSE:Linux Enterprise Module for Basesystem 15 SP7 cosign 0 3.0.5-150400.3.35.1
Wolfi aactl 0 0.4.12-r41
Wolfi cosign 0 3.0.4-r1
Wolfi falco-no-driver 0 0.43.0-r1
Wolfi falcoctl 0 0.12.0-r0
Wolfi gitsign 0 0.14.0-r0
Wolfi gitsign-credential-cache 0 0.14.0-r0
Wolfi kots 0 1.129.3-r0
Wolfi kubescape 0 3.0.48-r0
Wolfi sigstore-scaffolding-ctlog-createctconfig 0 0.7.31-r4
Wolfi sigstore-scaffolding-ctlog-managectroots 0 0.7.31-r4
Wolfi sigstore-scaffolding-ctlog-verifyfulcio 0 0.7.31-r4
Wolfi skopeo 0 1.21.0-r2
Wolfi slsa-verifier 0 2.7.1-r6
Wolfi tekton-chains 0 0.26.0-r6
Wolfi vexctl 0 0.4.1-r5
Wolfi witness 0 0.10.2-r0
Wolfi zarf 0 0.70.1-r0
openSUSE:Leap 15.6 cosign 0 3.0.5-150400.3.35.1
openSUSE:Leap 15.6 govulncheck-vulndb 0 0.0.20260123T022811-150000.1.140.1
openSUSE:Leap 15.6 vexctl 0 0.4.1+git78.f951e3a-150000.1.11.1
openSUSE:Leap 16.0 cosign 0 3.0.5-160000.1.1
openSUSE:Leap 16.0 hauler 0 1.4.1-bp160.1.1
openSUSE:Tumbleweed cosign 0 3.0.5-1.1
openSUSE:Tumbleweed hauler 0 1.4.1-1.1
openSUSE:Tumbleweed vexctl 0 0.4.1+git78.f951e3a-1.1

Related vulnerabilities