github.com/sigstore/fulcio vulnerabilities (Go)

3 vulnerabilities.

• github.com/sigstore/fulcio Go Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage CVE-2026-49478 Fix available 8.7 HighJune 30, 2026
• github.com/sigstore/fulcio Go Fulcio vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass CVE-2026-22772 Fix available 5.8 MediumJanuary 12, 2026
• github.com/sigstore/fulcio Go Fulcio allocates excessive memory during token parsing CVE-2025-66506 Fix available 7.5 HighDecember 4, 2025