VDB
CVE-2026-49478
CVE-2026-49478
PUBLISHED
CVSS 8.699999809265137 HIGH
Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage
EPSS 0.28% · 20.7th percentile
Risk Scores
CVSS 3.1
8.699999809265137
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
EPSS Score
0.28%
20.7th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| wolfi | witness | 0 |
| chainguard | zarf-fips | 0 |
| chainguard | kyverno-notation-aws | 0 |
| chainguard | kyverno-fips-1.15 | 0 |
| chainguard | skopeo | 0 |
| chainguard | kyverno-fips-1.17 | 0 |
| chainguard | slsa-verifier | 0 |
| chainguard | chainctl-fips | 0 |
| chainguard | podman | 0 |
| wolfi | kots | 0 |
| chainguard | kots | 0 |
| wolfi | kyverno-1.16 | 0 |
| chainguard | kubescape | 0 |
| chainguard | kubescape-server | 0 |
| wolfi | buildah | 0 |
| chainguard | tekton-chains | 0 |
| chainguard | flux-source-controller-fips | 0 |
| wolfi | podman | 0 |
| chainguard | kyverno-fips-1.18 | 0 |
| chainguard | commercial-kyverno-1.17 | 0 |
…and 45 more
Timeline
- Jun 30, 2026 CVE Published
- Jul 1, 2026 Security Advisory
- Aug 24, 2026 EPSS Score
- Sep 5, 2026 EPSS Score
- Sep 15, 2026 EPSS Score
- Sep 24, 2026 EPSS Score
- Sep 26, 2026 EPSS Score
- Sep 30, 2026 EPSS Score
- Oct 3, 2026 EPSS Score
- Oct 7, 2026 EPSS Score
- Oct 11, 2026 EPSS Score
- Oct 14, 2026 EPSS Score
References
- https://github.com/sigstore/fulcio/commit/378c654f48c3bafdced04ead7010aab2cb4c6ca1 fix
- https://nvd.nist.gov/vuln/detail/CVE-2026-49478 advisory
- https://github.com/advisories/GHSA-f5mr-q85p-6hh6 advisory
- https://github.com/sigstore/fulcio/security/advisories/GHSA-f5mr-q85p-6hh6 url
- https://github.com/sigstore/fulcio/pull/2354 fix
- https://github.com/sigstore/fulcio/releases/tag/v1.8.6 fix