{"id":"CVE-2026-49478","title":"Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity","summary":"Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discover…","severity":"high","cvss":8.7,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","cwe":["CWE-918"],"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","affected":["assisted_installer_for_red_hat_openshift_container_platform 2","confidential_compute_attestation","kernel_module_management_operator_for_red_hat_openshift","lightspeed_core","logging_subsystem_for_red_hat_openshift","logical_volume_manager_storage","migration_toolkit_for_containers","migration_toolkit_for_virtualization","multiarch_tuning_operator","multicluster_engine_for_kubernetes","node_healthcheck_operator","openshift_api_for_data_protection","openshift_developer_tools_and_services","openshift_lightspeed","openshift_pipelines","openshift_serverless","openshift_service_mesh 3","pen_drive_powered_by_red_hat_lightspeed","power_monitoring_for_red_hat_openshift","advanced_cluster_management_for_kubernetes 2","advanced_cluster_security 4","ansible_automation_platform 2","developer_hub","enterprise_linux 10","enterprise_linux 9","openshift_ai_rhoai","openshift_container_platform 4","openshift_data_foundation 4","openshift_dev_spaces","openshift_gitops","openshift_virtualization 4","openstack_platform 18.0","quay 3","trusted_artifact_signer","security_profiles_operator","self_service_automation_portal 2","advanced_cluster_security 4.9","advanced_cluster_security_for_kubernetes 4.10"],"patched":["advanced_cluster_security 4.9","advanced_cluster_security_for_kubernetes 4.10"],"published":"2026-08-13","updated":"2026-09-09","sourceUpdated":"2026-09-09T21:02:22.660","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-49478","references":[{"url":"https://github.com/sigstore/fulcio/commit/378c654f48c3bafdced04ead7010aab2cb4c6ca1","label":"security-advisories@github.com"},{"url":"https://github.com/sigstore/fulcio/pull/2354","label":"security-advisories@github.com"},{"url":"https://github.com/sigstore/fulcio/releases/tag/v1.8.6","label":"security-advisories@github.com"},{"url":"https://github.com/sigstore/fulcio/security/advisories/GHSA-f5mr-q85p-6hh6","label":"security-advisories@github.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49478.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-49478"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2499690"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-49478"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49478"},{"url":"https://access.redhat.com/errata/RHSA-2026:48872"},{"url":"https://access.redhat.com/errata/RHSA-2026:48913"},{"url":"https://github.com/advisories/GHSA-f5mr-q85p-6hh6"}],"tags":["nvd","csaf","vex","red-hat","ghsa","go","score-dispute"],"epss":0.00175,"epssPercentile":0.07229,"ecosystem":"go","scores":{"nvd":8.7,"vendor":6.5},"ingestedAt":"2026-06-30T21:24:14.395Z","slug":"CVE-2026-49478","body":"## Overview\n\nFulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a malicious or compromised issuer to perform blind SSRF, substitute and cache malicious JWKS keys, or disclose ServiceAccount tokens to external hosts. Version 1.8.6 blocks cross-host redirects, restricts token injection, and restricts local token loading. No known workarounds are available.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-49478)\n\nAffected packages:\n\n- `github.com/sigstore/fulcio <= 1.8.5`\n\nPatched in:\n\n- `github.com/sigstore/fulcio 1.8.6`\n\nSource: https://github.com/advisories/GHSA-f5mr-q85p-6hh6\n\n## Vendor advisories\n\n- **RHSA-2026:48872** · Red Hat · fixed in: Red Hat Advanced Cluster Security 4.9 · released 2026-07-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:48872)\n- **RHSA-2026:48913** · Red Hat · fixed in: Red Hat Advanced Cluster Security for Kubernetes 4.10 · released 2026-07-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:48913)\n- **Red Hat VEX** · Moderate · affected: Assisted Installer for Red Hat OpenShift Container Platform 2, Confidential Compute Attestation, Kernel Module Management Operator for Red Hat Openshift, Lightspeed Core, Logging Subsystem for Red Hat OpenShift, Logical Volume Manager Storage, … · no fix planned: Multicluster Engine for Kubernetes, Assisted Installer for Red Hat OpenShift Container Platform 2, Confidential Compute Attestation, Kernel Module Management Operator for Red Hat Openshift, … · updated 2026-09-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49478.json)","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":47.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":201709,"id":"CVE-2026-49478","ts":1789399642405,"field":"cvss","old":"6.5","new":"8.7"},{"seq":201708,"id":"CVE-2026-49478","ts":1789399642405,"field":"severity","old":"medium","new":"high"},{"seq":200441,"id":"CVE-2026-49478","ts":1789397269671,"field":"cvss","old":"8.7","new":"6.5"},{"seq":200440,"id":"CVE-2026-49478","ts":1789397269671,"field":"severity","old":"high","new":"medium"},{"seq":198364,"id":"CVE-2026-49478","ts":1789391867197,"field":"cvss","old":"6.5","new":"8.7"},{"seq":198363,"id":"CVE-2026-49478","ts":1789391867197,"field":"severity","old":"medium","new":"high"},{"seq":196156,"id":"CVE-2026-49478","ts":1789383521967,"field":"cvss","old":"8.7","new":"6.5"},{"seq":196155,"id":"CVE-2026-49478","ts":1789383521967,"field":"severity","old":"high","new":"medium"},{"seq":195085,"id":"CVE-2026-49478","ts":1789380405014,"field":"cvss","old":"6.5","new":"8.7"},{"seq":195084,"id":"CVE-2026-49478","ts":1789380405014,"field":"severity","old":"medium","new":"high"},{"seq":193872,"id":"CVE-2026-49478","ts":1789378389288,"field":"cvss","old":"8.7","new":"6.5"},{"seq":193871,"id":"CVE-2026-49478","ts":1789378389288,"field":"severity","old":"high","new":"medium"},{"seq":192659,"id":"CVE-2026-49478","ts":1789376347472,"field":"cvss","old":"6.5","new":"8.7"},{"seq":192658,"id":"CVE-2026-49478","ts":1789376347472,"field":"severity","old":"medium","new":"high"},{"seq":191446,"id":"CVE-2026-49478","ts":1789373290092,"field":"cvss","old":"8.7","new":"6.5"},{"seq":191445,"id":"CVE-2026-49478","ts":1789373290092,"field":"severity","old":"high","new":"medium"},{"seq":190231,"id":"CVE-2026-49478","ts":1789369239132,"field":"cvss","old":"6.5","new":"8.7"},{"seq":190230,"id":"CVE-2026-49478","ts":1789369239132,"field":"severity","old":"medium","new":"high"},{"seq":189018,"id":"CVE-2026-49478","ts":1789368169914,"field":"cvss","old":"8.7","new":"6.5"},{"seq":189017,"id":"CVE-2026-49478","ts":1789368169914,"field":"severity","old":"high","new":"medium"},{"seq":187801,"id":"CVE-2026-49478","ts":1789365092508,"field":"cvss","old":"6.5","new":"8.7"},{"seq":187800,"id":"CVE-2026-49478","ts":1789365092508,"field":"severity","old":"medium","new":"high"},{"seq":186588,"id":"CVE-2026-49478","ts":1789363154679,"field":"cvss","old":"8.7","new":"6.5"},{"seq":186587,"id":"CVE-2026-49478","ts":1789363154679,"field":"severity","old":"high","new":"medium"},{"seq":185374,"id":"CVE-2026-49478","ts":1789361045334,"field":"cvss","old":"6.5","new":"8.7"},{"seq":185373,"id":"CVE-2026-49478","ts":1789361045334,"field":"severity","old":"medium","new":"high"},{"seq":184161,"id":"CVE-2026-49478","ts":1789358056070,"field":"cvss","old":"8.7","new":"6.5"},{"seq":184160,"id":"CVE-2026-49478","ts":1789358056070,"field":"severity","old":"high","new":"medium"},{"seq":182412,"id":"CVE-2026-49478","ts":1789354171003,"field":"cvss","old":"6.5","new":"8.7"},{"seq":182411,"id":"CVE-2026-49478","ts":1789354171003,"field":"severity","old":"medium","new":"high"},{"seq":181205,"id":"CVE-2026-49478","ts":1789353038191,"field":"cvss","old":"8.7","new":"6.5"},{"seq":181204,"id":"CVE-2026-49478","ts":1789353038191,"field":"severity","old":"high","new":"medium"},{"seq":179998,"id":"CVE-2026-49478","ts":1789350107600,"field":"cvss","old":"6.5","new":"8.7"},{"seq":179997,"id":"CVE-2026-49478","ts":1789350107600,"field":"severity","old":"medium","new":"high"},{"seq":178791,"id":"CVE-2026-49478","ts":1789347993108,"field":"cvss","old":"8.7","new":"6.5"},{"seq":178790,"id":"CVE-2026-49478","ts":1789347993108,"field":"severity","old":"high","new":"medium"},{"seq":177584,"id":"CVE-2026-49478","ts":1789346238969,"field":"cvss","old":"6.5","new":"8.7"},{"seq":177583,"id":"CVE-2026-49478","ts":1789346238969,"field":"severity","old":"medium","new":"high"},{"seq":176377,"id":"CVE-2026-49478","ts":1789342907424,"field":"cvss","old":"8.7","new":"6.5"},{"seq":176376,"id":"CVE-2026-49478","ts":1789342907424,"field":"severity","old":"high","new":"medium"},{"seq":175831,"id":"CVE-2026-49478","ts":1789338691651,"field":"cvss","old":"6.5","new":"8.7"},{"seq":175830,"id":"CVE-2026-49478","ts":1789338691651,"field":"severity","old":"medium","new":"high"},{"seq":175701,"id":"CVE-2026-49478","ts":1789338511546,"field":"cvss","old":"8.7","new":"6.5"},{"seq":175700,"id":"CVE-2026-49478","ts":1789338511546,"field":"severity","old":"high","new":"medium"},{"seq":174496,"id":"CVE-2026-49478","ts":1789334700972,"field":"cvss","old":"6.5","new":"8.7"},{"seq":174495,"id":"CVE-2026-49478","ts":1789334700972,"field":"severity","old":"medium","new":"high"},{"seq":173291,"id":"CVE-2026-49478","ts":1789333381687,"field":"cvss","old":"8.7","new":"6.5"},{"seq":173290,"id":"CVE-2026-49478","ts":1789333381687,"field":"severity","old":"high","new":"medium"},{"seq":172105,"id":"CVE-2026-49478","ts":1789330951358,"field":"cvss","old":"6.5","new":"8.7"},{"seq":172104,"id":"CVE-2026-49478","ts":1789330951358,"field":"severity","old":"medium","new":"high"}]}