VDB

CVE-2026-49478

CVE-2026-49478 PUBLISHED CVSS 8.7 HIGH

Reported by GitHub_M · Published August 13, 2026

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a malicious or compromised issuer to perform blind SSRF, substitute and cache malicious JWKS keys, or disclose ServiceAccount tokens to external hosts. Version 1.8.6 blocks cross-host redirects, restricts token injection, and restricts local token loading. No known workarounds are available.

Risk Scores

CVSS 3.1
8.7
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Affected Products

VendorProductVersions
sigstorefulcio< 1.8.6
wolfiwitness0
chainguardzarf-fips0
chainguardkyverno-notation-aws0
chainguardkyverno-fips-1.150
chainguardskopeo0
chainguardkyverno-fips-1.170
chainguardslsa-verifier0
chainguardchainctl-fips0
chainguardpodman0
wolfikots0
chainguardkots0
wolfikyverno-1.160
chainguardkubescape0
chainguardkubescape-server0
wolfibuildah0
chainguardtekton-chains0
chainguardflux-source-controller-fips0
wolfipodman0
chainguardkyverno-fips-1.180

…and 46 more

Timeline

  • Jun 30, 2026 CVE Published
  • Jul 1, 2026 Security Advisory
  • Aug 24, 2026 EPSS Score
  • Sep 5, 2026 EPSS Score
  • Sep 15, 2026 EPSS Score
  • Sep 24, 2026 EPSS Score
  • Sep 26, 2026 EPSS Score
  • Sep 30, 2026 EPSS Score
  • Oct 3, 2026 EPSS Score
  • Oct 7, 2026 EPSS Score
  • Oct 11, 2026 EPSS Score
  • Oct 14, 2026 EPSS Score

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›