fulcio vulnerabilities

2 known vulnerabilities in fulcio from Sigstore. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.7 High severity

  fulcio: Server-Side Request Forgery

  CVE-2026-49478Aug 13, 2026Sigstore

  Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a malicious

• 7.5 High severity

  fulcio: Asymmetric Resource Consumption (Amplification)

  CVE-2025-66506Dec 4, 2025Sigstore

  Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.3, function identity.extractIssuerURL splits (via a call to strings.Split) its argument (which is untrusted data) on periods