{"id":"GO-2026-5853","revision":"fa661a5acd384c2bacfab286454f5b63","records":[{"revision":"fa661a5acd384c2bacfab286454f5b63","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5853","aliases":["CVE-2026-49478","GHSA-f5mr-q85p-6hh6"],"title":"Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage in github.com/sigstore/fulcio","description":"Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage in github.com/sigstore/fulcio","state":0,"publishedAt":"2026-07-07T15:26:32+00:00","modifiedAt":"2026-07-10T18:29:34.7401869+00:00","affected":[{"ecosystem":"Go","name":"github.com/sigstore/fulcio","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.8.6"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/sigstore/fulcio/security/advisories/GHSA-f5mr-q85p-6hh6"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5853","license":"OSV · upstream source license applies","key":"osv:GO-2026-5853","identifiers":["GO-2026-5853","CVE-2026-49478","GHSA-f5mr-q85p-6hh6"]},"retained":false,"historicalAffected":[]}],"coverage":[]}