fulcio

Fulcio Una CA gratuita per la firma del codice Fulcio è un'autorità di certificazione a uso gratuito per l'emissione di certificati di firma del codice per un'identità OpenID Connect OIDC, come un indirizzo email. Fulcio emette solo certificati di breve durata validi per 10 minuti. Istanza pubbli...

GO-2024-2883 vulnerabilities

Vulnerabilities for packages: timestamp-authority, grafana-mimir, rekor, prometheus-alertmanager, fulcio, cortex...

GO-2024-2978 vulnerabilities

Vulnerabilities for packages: trivy, sops, cloudnative-pg, melange, opentelemetry-collector, spire-server, osv-scanner, terragrunt, hubble-ui, gomplate, grafana-mimir, fulcio, grafana-agent-operator, minio, conftest, kube-rbac-proxy, kwok, dbmate, k8sgpt, restic, tempo, certificate-transparency,...

GO-2026-4394 vulnerabilities

Vulnerabilities for packages: trivy, external-secrets-operator, blob-csi, tekton-chains, kube-vip-cloud-provider, prometheus-alertmanager, rke2-cloud-provider, sftpgo, cluster-autoscaler, syft, minio, flyte, kube-metrics-adapter, trillian, kubernetes-csi-external-resizer, dagdotdev, vault-env,...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: trino, goreleaser, chezmoi, trivy, py3-cassandra-medusa, nuclei, sops, terragrunt, timestamp-authority, hugo, opentelemetry-collector, spire-server, tekton-chains, buildkitd, bank-vaults, grafana-mimir, flux, druid, prometheus-operator, fulcio, thanos,...

GO-2025-4007 vulnerabilities

Vulnerabilities for packages: trivy, fq, kube-vip-cloud-provider, kubernetes-dashboard-web, prometheus-alertmanager, protoc-gen-go, timescaledb-parallel-copy, kafka-proxy, grpc-health-probe, yunikorn-k8shim, spark-operator, vault-env, gitleaks, kubescape-operator, vendir, controller-gen,...

GO-2023-2334 vulnerabilities

Vulnerabilities for packages: oauth2-proxy, sops, terragrunt, gitsign, spire-server, aactl, cloudflared, tekton-chains, fulcio, kubescape, tkn, vexctl, dex, flux-source-controller, argo-workflows, kots, cosign, flux-kustomize-controller, rekor, slsa-verifier...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: trivy, external-secrets-operator, aactl, tekton-chains, flux, gitlab-kas, prometheus-operator, argo-cd, syft, minio, snyk-cli, terraform-provider-tls, kaf, pulumi-language-yaml, pulumi-kubernetes-operator, zot, rancher-machine, crossplane-provider-azure-authorization...

GO-2025-3849 vulnerabilities

Vulnerabilities for packages: trivy, fq, kubernetes-dashboard-web, crossplane-provider-azure, timescaledb-parallel-copy, snyk-cli, grpc-health-probe, influx, yunikorn-k8shim, vault-env, zot, local-static-provisioner, kubescape-operator, rancher-fleet, crossplane-provider-azure-authorization,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: aws-application-networking-k8s, trivy, oauth2-proxy, aactl, tekton-chains, kubernetes-dashboard-web, flux, ipfs-cluster, prometheus-operator, nri-rabbitmq, cis-operator, docker-credential-gcr, tempo, lazydocker, terraform, yunikorn-k8shim, spark-operator, mongo-tools...

GO-2025-3488 vulnerabilities

Vulnerabilities for packages: trivy, tekton-chains, kubernetes-dashboard-web, prometheus-alertmanager, crossplane-provider-azure, snyk-cli, linkerd2, kafka-proxy, yunikorn-k8shim, spark-operator, zot, local-static-provisioner, rancher-fleet, vendir, crossplane-provider-azure-authorization,...

GO-2024-2888 vulnerabilities

Vulnerabilities for packages: trivy, fq, tekton-chains, prometheus-alertmanager, protoc-gen-go, crossplane-provider-azure, snyk-cli, kafka-proxy, grpc-health-probe, influx, kubernetes-ingress-defaultbackend, gitleaks, local-static-provisioner, kyverno-policy-reporter, kaniko,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: flux-helm-controller, goreleaser, nuclei, crossplane-provider-azure-managedidentity, sops, terragrunt, timestamp-authority, gitsign, opentelemetry-collector, spire-server, aactl, buildkitd, bank-vaults, gomplate, flux, grafana-mimir,...

CVE-2026-49478

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect OIDC identity. Versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a malicious or compromised issuer to perform blind...

CVE-2026-49478

Fulcio (certificate authority for OpenID Connect) reports a vulnerability in OIDC discovery across versions up to 1.8.5 where cross-host redirects attach Kubernetes ServiceAccount tokens, enabling blind SSRF, JWKS key substitution/poisoning, and potential leakage of tokens to external hosts. The ...

CVE-2026-49478

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect OIDC identity. Versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a malicious or compromised issuer to perform blind...

CVE-2026-49478 Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect OIDC identity. Versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a malicious or compromised issuer to perform blind...

CVE-2026-49478 Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect OIDC identity. Versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a malicious or compromised issuer to perform blind...

CLEANSTART-2026-TD64731 Security fixes in fulcio 1.8.7-r2

Package fulcio version 1.8.7-r2 fixes 3 vulnerabilities: ghsa-vgwf-h737-ff37, ghsa-f5wc-c3c7-36mc, ghsa-5cgq-3rg8-m6cv...

CVE-2026-48791

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated Rekor entry time against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verificati...