Most recent entries from all

Withdrawn: CLEANSTART-2026-BA61304 — Security fixes in cosign 2.4.3-r0

Withdrawn by the publisher.

Affected: CleanStart: cosign

Package cosign version 2.4.3-r0 fixes 82 vulnerabilities: CVE-2025-0913, CVE-2025-15558, CVE-2025-22868, CVE-2025-22869, CVE-2025-22870...

EUVD-2026-265491

fkie_cve-2026-22772

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.5, Fulcio's metaRegex() function uses unanchored regex, allowing attackers to bypass MetaIssuer URL validation and trigger SSRF to arbitrary internal services. Since the SSRF only can trigger GET requests, the request cannot mutate state. The response from the GET request is not returned to the caller so data exfiltration is not possible. A malicious actor could attempt to probe an internal network through Blind SSRF. This vulnerability is fixed in 1.8.5.

GHSA-59jp-pj84-45mr — Fulcio is vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass

Affected: Go: github.com/sigstore/fulcio

# Security Disclosure: SSRF via MetaIssuer Regex Bypass

## Summary

Fulcio's `metaRegex()` function uses unanchored regex, allowing attackers to bypass MetaIssuer URL validation and trigger SSRF to arbitrary internal services.

Since the SSRF only can trigger GET requests, the request cannot mutate state. The response from the GET request is not returned to the caller so data exfiltration is not possible. A malicious actor could attempt to probe an internal network through [Blind SSRF](https://portswigger.net/web-security/ssrf/blind).

## Impact

- SSRF to cloud metadata (169.254.169.254) - SSRF to internal Kubernetes APIs - SSRF to any service accessible from Fulcio's network - Affects ALL deployments using MetaIssuers

## Patches

Upgrade to v1.8.5.

## Workarounds

None. If anchors are included in the meta issuer configuration URL, they will be escaped before the regular expression is compiled, not making this a sufficient mitigation. Deployments must upgrade to the latest Fulcio release v1.8.5.

## Affected Code

**File**: `pkg/config/config.go` **Function**: `metaRegex()` (lines 143-156)

```go func metaRegex(issuer string) (*regexp.Regexp, error) { quoted := regexp.QuoteMeta(issuer) replaced := strings.ReplaceAll(quoted, regexp.QuoteMeta("*"), "[-_a-zA-Z0-9]+") return regexp.Compile(replaced) // Missing ^ and $ anchors } ```

## The Bug

The regex has no `^` (start) or `$` (end) anchors. Go's `regexp.MatchString()` does substring matching, so:

``` Patt…

openSUSE-RU-2026:20161-1 — Recommended update for hauler

Recommended update for hauler

RHSA-2026:2136 — Red Hat Security Advisory: RHTAS 1.3.2 - Red Hat Trusted Artifact Signer Release

golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate github.com/sigstore/fulcio: Fulcio: Denial of Service via crafted OpenID Connect (OIDC) token fulcio: Fulcio: Server-Side Request Forgery (SSRF) via unanchored regex in MetaIssuer URL validation

SUSE-SU-2026:0592-1 — Security update for vexctl

Security update for vexctl

UBUNTU-CVE-2026-22772

Affected: Ubuntu:25.10: golang-github-sigstore-fulcio, Ubuntu:26.04:LTS: golang-github-sigstore-fulcio