CVE-2026-49478

{
  "id": "CVE-2026-49478",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-13T13:19:09.790",
  "lastModified": "2026-10-24T16:10:00.153",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a malicious or compromised issuer to perform blind SSRF, substitute and cache malicious JWKS keys, or disclose ServiceAccount tokens to external hosts. Version 1.8.6 blocks cross-host redirects, restricts token injection, and restricts local token loading. No known workarounds are available."
    },
    {
      "lang": "es",
      "value": "Fulcio es una autoridad de certificación para emitir certificados de firma de código para una identidad de OpenID Connect (OIDC). Las versiones hasta la 1.8.5 siguen incorrectamente las redirecciones entre hosts y adjuntan tokens de Kubernetes ServiceAccount durante el descubrimiento de OIDC, lo que permite a un emisor malicioso o comprometido realizar SSRF ciego, sustituir y almacenar en caché claves JWKS maliciosas, o divulgar tokens de ServiceAccount a hosts externos. La versión 1.8.6 bloquea las redirecciones entre hosts, restringe la inyección de tokens y restringe la carga local de tokens. No se conocen soluciones alternativas disponibles."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "sigstore",
          "product": "fulcio",
          "versions": [
            {
              "version": "< 1.8.6",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.8
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-15T03:14:38.396830Z",
          "id": "CVE-2026-49478",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/sigstore/fulcio/commit/378c654f48c3bafdced04ead7010aab2cb4c6ca1",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/sigstore/fulcio/pull/2354",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/sigstore/fulcio/releases/tag/v1.8.6",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/sigstore/fulcio/security/advisories/GHSA-f5mr-q85p-6hh6",
      "source": "[email protected]"
    }
  ]
}