—

GO-2026-5853

Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage in github.com/sigstore/fulcio

Details

Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage in github.com/sigstore/fulcio

Are you affected?

Enter the version of the package you're using.

Affected packages

Go / github.com/sigstore/fulcio

Introduced in: 0 Fixed in: 1.8.6

Fix go get github.com/sigstore/fulcio@v1.8.6

References

https://github.com/sigstore/fulcio/security/advisories/GHSA-f5mr-q85p-6hh6 [ADVISORY]