5.3

CVE-2026-24117: linuxfoundation rekor Server-Side Request Forgery (SSRF)

CVSS: 5.3v3.1MediumAnalyzed
AliasesUBUNTU-CVE-2026-24117DEBIAN-CVE-2026-24117CGA-3hg2-7877-fggm
Published 22-01-2026Last modified 23-01-2026
Open JSON

Vulnerability summary

CVE-2026-24117 is a medium (CVSS 5.3) Server-Side Request Forgery (SSRF) vulnerability in linuxfoundation rekor. EPSS estimates a 0.36% chance of exploitation in the next 30 days, higher than 28.7% of scored vulnerabilities.

Overall risk
21/100
0100
Low · default modelHow is this calculated?
CVSS score
5.3/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.36%
0%100%
Low · -0.01 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 3 · Related 4
OPENSUSE-SU-2026:10127-1OPENSUSE-SU-2026:21483-1SUSE-SU-2026:0403-1CGA-9M54-986W-G7RM

Timeline

  1. 22-01-2026
    PublishedVulnerability first disclosed.
  2. 23-01-2026
    Last modifiedVulnerability information updated.

Description

Rekor is a software supply chain transparency log. In versions 1.4.3 and below, attackers can trigger SSRF to arbitrary internal services because /api/v1/index/retrieve supports retrieving a public key via user-provided URL. Since the SSRF only can trigger GET requests, the request cannot mutate state. The response from the GET request is not returned to the caller so data exfiltration is not possible. A malicious actor could attempt to probe an internal network through Blind SSRF. The issue has been fixed in version 1.5.0. To workaround this issue, disable the search endpoint with --enable_retrieve_api=false.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

0.36%

Chance of exploitation in the next 30 days

Percentile

29%

Versus all other CVEs

30-day change

-0.01 pp

From 0.37% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.36%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard133 products
  • aactl< 0.4.12-r42
  • buildkitd< 0.27.1-r1
  • buildkitd-fips< 0.27.1-r0
  • cg< 0.2.200-r0
  • chainctl< 0.2.197-r0
Wolfi36 products
  • aactl< 0.4.12-r42
  • buildkitd< 0.27.1-r1
  • cosign< 3.0.4-r2
  • crossplane-2.1< 2.1.3-r4
  • falcoctl< 0.12.2-r0
Debian1 product
  • rekorAll versions (No fix recorded) | < 1.5.0-1
Github.com/sigstore1 product
  • rekor< 1.5.0
Linuxfoundation1 product
Sigstore1 product
Ubuntu1 product
  • rekorAll versions (No fix recorded)

7 vendors · 174 products

References

9 links