CVE-2026-22772

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect OIDC identity. Prior to 1.8.5, Fulcio's metaRegex function uses unanchored regex, allowing attackers to bypass MetaIssuer URL validation and trigger SSRF to arbitrary internal services. Since the SSRF on...

Fulcio 代码问题漏洞

Fulcio is a certificate authority open-sourced by sigstore. A code issue vulnerability exists in Fulcio versions prior to 1.8.5 that stems from the use of unanchored regular expressions for MetaIssuer URL validation, which could lead to bypassing validation and triggering a blind SSRF attack...