GO-2026-4311
Fulcio is vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass in github.com/sigstore/fulcio
At a glance
- Published
- Updated
- CVE
- CVE-2026-22772
- Aliases
- GHSA-59jp-pj84-45mr
Description
Fulcio is vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass in github.com/sigstore/fulcio
Affected packages
| Package | Versions |
|---|---|
| Go · github.com/sigstore/fulcio | introduced 0, fixed 1.8.5 |
References
- https://github.com/sigstore/fulcio/security/advisories/GHSA-59jp-pj84-45mr ADVISORY
- https://nvd.nist.gov/vuln/detail/CVE-2026-22772 ADVISORY
- https://github.com/sigstore/fulcio/commit/eaae2f2be56df9dea5f9b439ec81bedae4c0978d FIX
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |