GO-2024-2883 vulnerabilities

Vulnerabilities for packages: rekor, timestamp-authority, cortex, fulcio, prometheus-alertmanager, grafana-mimir...

GO-2024-2978 vulnerabilities

Vulnerabilities for packages: step, kaniko, minio, kwok, k8sgpt-operator, trivy, conftest, grafana-mimir, opentelemetry-collector-contrib, vcluster, rqlite, pulumi-language-dotnet, spegel, grpc-health-probe, tflint, tempo, kargo, zot, gomplate, hubble-ui, kube-rbac-proxy, dagger, dex, zarf,...

GO-2026-4394 vulnerabilities

Vulnerabilities for packages: prometheus, kwok, cortex, hydra, kubernetes-csi-external-attacher, traefik, otel-cli, grafana, cluster-api-helm-controller, azurefile-csi, argo-workflows, fluent-operator, sftpgo-plugin-kms, k6, grafana-pyroscope, syft, policy-controller, external-secrets-operator,...

GO-2025-4007 vulnerabilities

Vulnerabilities for packages: envconsul, contour, swagger, infinispan-operator, rancher-loglevel, k8sgpt-operator, nerdctl, nova, neuvector-dbgen, protoc-gen-go-grpc, ytt, flannel, nsc, kubernetes-event-exporter, xcover, redka, cri-tools, certificate-transparency, cfssl, falco-exporter, xcaddy,...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: rekor, step, prometheus-operator, flux-kustomize-controller, cortex, nuclei, trivy, grafana-mimir, airflow, rclone, up, trino, opentelemetry-collector-contrib, tekton-chains, chezmoi, thanos, tempo, argo-events, falcoctl, fluent-bit-plugin-loki, zot, tkn,...

GO-2023-2334 vulnerabilities

Vulnerabilities for packages: rekor, flux-kustomize-controller, tekton-chains, tkn, argo-workflows, kubescape, dex, cloudflared, fulcio, aactl, gitsign, terragrunt, spire-server, slsa-verifier, oauth2-proxy, cosign, kots, vexctl, sops, flux-source-controller...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: argo-cd, prometheus, flux-kustomize-controller, crossplane-provider-aws-cloudfront, nuclei, cilium, traefik, crossplane-provider-aws-memorydb, chezmoi, nerdctl, sealed-secrets, argo-events, crossplane-provider-keycloak, pulumi-language-yaml,...

GO-2025-3849 vulnerabilities

Vulnerabilities for packages: swagger, rancher-loglevel, trino, nerdctl, pdfcpu, nova, neuvector-dbgen, ytt, rabbitmq-messaging-topology-operator, kubernetes-dashboard, fluxcd-kustomize-mutating-webhook, redka, cri-tools, certificate-transparency, cfssl, k8sgpt, aws-flb-cloudwatch, falco-exporter...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: envconsul, nri-redis, prometheus, swagger, nuclei, kubernetes-dashboard-auth, nri-haproxy, kube-bench, argo-events, nova, cluster-api-helm-controller, chartmuseum, rabbitmq-messaging-topology-operator, harbor-cli, kubernetes-dashboard, dex, terraform-provider-azapi,...

GO-2025-3488 vulnerabilities

Vulnerabilities for packages: k8sgpt-operator, fluent-operator, flannel, rabbitmq-messaging-topology-operator, kubernetes-dashboard, kubernetes-event-exporter, cri-tools, certificate-transparency, k8sgpt, aws-efs-csi-driver, aws-application-networking-k8s, src, atlantis, k9s,...

GO-2024-2888 vulnerabilities

Vulnerabilities for packages: swagger, nerdctl, neuvector-dbgen, protoc-gen-go-grpc, fluent-operator, ytt, flannel, rabbitmq-messaging-topology-operator, kubernetes-dashboard, nsc, kubernetes-event-exporter, nri-nginx, redka, cri-tools, certificate-transparency, cfssl, k8sgpt, aws-flb-cloudwatch,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: rekor, crossplane-provider-family-azure, flux-kustomize-controller, snyk-cli, nuclei, grafana-mimir, src-fingerprint, actions-runner-controller, opentelemetry-collector-contrib, flux-notification-controller, scorecard, tekton-chains, flux-image-automation-controller,...

CVE-2026-49478

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect OIDC identity. Versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a malicious or compromised issuer to perform blind...

CVE-2026-49478

Fulcio (certificate authority for OpenID Connect) reports a vulnerability in OIDC discovery across versions up to 1.8.5 where cross-host redirects attach Kubernetes ServiceAccount tokens, enabling blind SSRF, JWKS key substitution/poisoning, and potential leakage of tokens to external hosts. The ...

CVE-2026-49478

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect OIDC identity. Versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a malicious or compromised issuer to perform blind...

CVE-2026-49478 Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect OIDC identity. Versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a malicious or compromised issuer to perform blind...

CVE-2026-49478 Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect OIDC identity. Versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a malicious or compromised issuer to perform blind...

CLEANSTART-2026-TD64731 Security fixes in fulcio 1.8.7-r2

Package fulcio version 1.8.7-r2 fixes 3 vulnerabilities: ghsa-vgwf-h737-ff37, ghsa-f5wc-c3c7-36mc, ghsa-5cgq-3rg8-m6cv...

CVE-2026-48791

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated Rekor entry time against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verificati...

CVE-2026-48791

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated Rekor entry time against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verificati...