sigstore/fulcio Security Advisories | GitStock

high2026-06-30

Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage

GHSA-f5mr-q85p-6hh6 · CVE-2026-49478

medium2026-01-13

Fulcio is vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass

GHSA-59jp-pj84-45mr · CVE-2026-22772

high2025-12-05

Fulcio allocates excessive memory during token parsing

GHSA-f83f-xpx7-ffpw · CVE-2025-66506