CVE-2026-22772: Fulcio vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass

Analyzed

AliasesUBUNTU-CVE-2026-22772DEBIAN-CVE-2026-22772CGA-22gx-2mr6-3895+143 more

Published 12-01-2026Last modified 12-01-2026

Vulnerability summary

CVE-2026-22772 is a medium (CVSS 5.8) Server-Side Request Forgery vulnerability in linuxfoundation fulcio. EPSS estimates a 0.23% chance of exploitation in the next 30 days, higher than 14.1% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Routine

Not severe (CVSS 5.8, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

5.8/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.23%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1github

Advisory lineage

Upstream 0 · Downstream 9 · Related 10

OPENSUSE-SU-2026:10230-1 OPENSUSE-SU-2026:10235-1 OPENSUSE-SU-2026:20386-1 OPENSUSE-SU-2026:21481-1 OPENSUSE-SU-2026:21483-1 SUSE-SU-2026:0292-1+4 more

Timeline

12-01-2026
PublishedVulnerability first disclosed.
12-01-2026
Last modifiedVulnerability information updated.

Description

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.5, Fulcio's metaRegex() function uses unanchored regex, allowing attackers to bypass MetaIssuer URL validation and trigger SSRF to arbitrary internal services. Since the SSRF only can trigger GET requests, the request cannot mutate state. The response from the GET request is not returned to the caller so data exfiltration is not possible. A malicious actor could attempt to probe an internal network through Blind SSRF. This vulnerability is fixed in 1.8.5.

CVSS metrics

7 scores · 7 sources · 1 version

v3.15.8

EPSS trend

Probability

0.23%

Chance of exploitation in the next 30 days

Percentile

14%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.24% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

githubUnverified
Fulcio
Maturity: poc

Weaknesses

CWE · root cause

CWE-918Server-Side Request ForgeryThe web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard68 products

aactl< 0.4.12-r41
chainctl< 0.2.197-r0
commercial-kyverno-1.15All versions (No fix recorded)
commercial-kyverno-background-controller-1.15All versions (No fix recorded)
commercial-kyverno-cleanup-controller-1.15All versions (No fix recorded)

commercial-kyverno-reports-controller-1.15All versions (No fix recorded)
commercial-kyvernopre-1.15All versions (No fix recorded)
cosign< 3.0.4-r1
falco-no-driver< 0.43.0-r1
falcoctl< 0.12.0-r0
falcoctl-fips< 0.12.1-r0
flux-source-controller-fips< 1.7.4-r5
gitsign< 0.14.0-r0
gitsign-credential-cache< 0.14.0-r0
image-factory< 0.9.0-r4
kots< 1.129.3-r0
kubescape< 3.0.48-r0
kyverno-1.13All versions (No fix recorded)
kyverno-1.14All versions (No fix recorded)
kyverno-1.15< 1.15.3-r23
kyverno-background-controller-1.13All versions (No fix recorded)
kyverno-background-controller-1.14All versions (No fix recorded)
kyverno-background-controller-1.15< 1.15.3-r23
kyverno-background-controller-fips-1.13All versions (No fix recorded)
kyverno-background-controller-fips-1.14All versions (No fix recorded)
kyverno-background-controller-fips-1.15< 1.15.20-r8
kyverno-cleanup-controller-1.13All versions (No fix recorded)
kyverno-cleanup-controller-1.14All versions (No fix recorded)
kyverno-cleanup-controller-1.15< 1.15.3-r23
kyverno-cleanup-controller-fips-1.13All versions (No fix recorded)
kyverno-cleanup-controller-fips-1.14All versions (No fix recorded)
kyverno-cleanup-controller-fips-1.15< 1.15.20-r8
kyverno-cli-1.13All versions (No fix recorded)
kyverno-cli-1.14All versions (No fix recorded)
kyverno-cli-1.15< 1.15.3-r23
kyverno-cli-fips-1.13All versions (No fix recorded)
kyverno-cli-fips-1.14All versions (No fix recorded)
kyverno-cli-fips-1.15< 1.15.20-r8
kyverno-fips-1.13All versions (No fix recorded)
kyverno-fips-1.14All versions (No fix recorded)
kyverno-fips-1.15< 1.15.20-r8
kyverno-init-container-1.13All versions (No fix recorded)
kyverno-init-container-1.14All versions (No fix recorded)
kyverno-init-container-1.15< 1.15.3-r23
kyverno-init-container-fips-1.13All versions (No fix recorded)
kyverno-init-container-fips-1.14All versions (No fix recorded)
kyverno-init-container-fips-1.15< 1.15.20-r8
kyverno-policy-reporter-plugins-kyverno-fips< 0.5.3-r6
kyverno-reports-controller-1.13All versions (No fix recorded)
kyverno-reports-controller-1.14All versions (No fix recorded)
kyverno-reports-controller-1.15< 1.15.3-r23
kyverno-reports-controller-fips-1.13All versions (No fix recorded)
kyverno-reports-controller-fips-1.14All versions (No fix recorded)
kyverno-reports-controller-fips-1.15< 1.15.20-r8
podman-fips< 5.7.1-r3
reports-serverAll versions (No fix recorded)
sigstore-scaffolding-ctlog-createctconfig< 0.7.31-r4
sigstore-scaffolding-ctlog-managectroots< 0.7.31-r4
sigstore-scaffolding-ctlog-verifyfulcio< 0.7.31-r4
sigstore-scaffolding-fips-ctlog-createctconfig< 0.7.31-r5
sigstore-scaffolding-fips-ctlog-managectroots< 0.7.31-r5
sigstore-scaffolding-fips-ctlog-verifyfulcio< 0.7.31-r5
skopeo< 1.21.0-r2
slsa-verifier< 2.7.1-r6
tekton-chains< 0.26.0-r6 | < 0.26.0-r5
vexctl< 0.4.1-r5
witness< 0.10.2-r0
zarf< 0.70.1-r0

Show all 68

Wolfi17 products

aactl< 0.4.12-r41
cosign< 3.0.4-r1
falco-no-driver< 0.43.0-r1
falcoctl< 0.12.0-r0
gitsign< 0.14.0-r0

Show all 17

Opensuse2 products

hauler&distro=openSUSE Leap 16.0< 1.4.1-bp160.1.1
hauler&distro=openSUSE Tumbleweed< 1.4.1-1.1

Debian1 product

golang-github-sigstore-fulcioAll versions (No fix recorded) | < 1.8.5-1

Github.com/sigstore1 product

fulcio< 1.8.5

Linuxfoundation1 product

fulcio< 1.8.5

Sigstore1 product

fulcio< 1.8.5

Ubuntu1 product

golang-github-sigstore-fulcioAll versions (No fix recorded)

8 vendors · 92 products

References

10 links

github.com/sigstore/fulcio/security/advisories/GHSA-59jp-pj84-45mrX Refsource CONFIRMREPORTAdvisoryWEBExploitVendor Advisory
github.com/sigstore/fulcio/commit/eaae2f2be56df9dea5f9b439ec81bedae4c0978dX Refsource MISCREPORTFIXWEBPatch
ubuntu.com/security/CVE-2026-22772REPORT
www.cve.org/CVERecord?id=CVE-2026-22772REPORT
security-tracker.debian.org/tracker/CVE-2026-22772Advisory
github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22772.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2026-22772Advisory
github.com/sigstore/fulcioPACKAGE
bugzilla.suse.com/1256546REPORT
www.suse.com/security/cve/CVE-2026-22772WEB