Executive brief
Sigstore Fulcio, a service used to issue certificates for secure software signing, contains vulnerabilities in how it handles identity provider connections. An attacker could trick the system into sending sensitive internal credentials to a malicious server or accept fraudulent security keys. This could allow an attacker to bypass security checks, forge digital signatures, or gain unauthorized access to internal Kubernetes environments.
Technical details
Sigstore Fulcio's OIDC discovery client fails to validate cross-host redirects when fetching metadata from `/.well-known/openid-configuration`. This allows an attacker to perform blind SSRF or point the `jwks_uri` to a malicious host, leading to JWKS substitution and cache poisoning of verification keys. Additionally, Fulcio's transport layer globally attached Kubernetes ServiceAccount tokens to outbound requests, causing token leakage if an issuer redirected to a third-party domain or if a wildcard MetaIssuer matched an external endpoint. These issues are addressed in version 1.8.6 by blocking cross-host redirects and restricting token injection to exact host matches.
Affected products
- Sigstore Fulcio <= 1.8.5
Timeline
- 2026-05-26: disclosed
- 2026-06-30: advisory: GitHub Advisory published
References
- https://api.github.com/users/bugbunny-research
- https://github.com/bugbunny-research
- https://api.github.com/users/bugbunny-research/gists%7B/gist_id%7D
- https://api.github.com/users/bugbunny-research/repos
- https://avatars.githubusercontent.com/u/262839898?v=4
- https://api.github.com/users/bugbunny-research/events%7B/privacy%7D