CVE-2026-22772

Aliases:GHSA-59jp-pj84-45mrGO-2026-4311
Advisory lineage Upstream: 0 Downstream: 11
Analyzed
Published: 12 Jan 2026, 20:58
Last modified:12 Jan 2026, 21:17

Vulnerability Summary

Overall Risk (default)
medium
33/100
CVSS Score
5.8 MEDIUM
v3.1 (cve.org)
EPSS Score
0.01% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

12 Jan 2026, 20:58
Published
Vulnerability first disclosed
12 Jan 2026, 21:17
Last Modified
Vulnerability information updated

Description

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.5, Fulcio's metaRegex() function uses unanchored regex, allowing attackers to bypass MetaIssuer URL validation and trigger SSRF to arbitrary internal services. Since the SSRF only can trigger GET requests, the request cannot mutate state. The response from the GET request is not returned to the caller so data exfiltration is not possible. A malicious actor could attempt to probe an internal network through Blind SSRF. This vulnerability is fixed in 1.8.5.

CVSS Metrics

  • v3.1•MEDIUM•Score: 5.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
  • v3.1•MEDIUM•Score: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS Trends

Current EPSS score: 0.01%• Percentile: 3%

Techniques & Countermeasures

  • CWE-918•Server-Side Request Forgery (SSRF)

    The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Affected Systems

  • github.com/sigstore•fulcio

    < 1.8.5

  • linuxfoundation•fulcio

    < 1.8.5

  • sigstore•fulcio

    < 1.8.5

References (4)