CVE-2026-22772

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.5, Fulcio's metaRegex() function uses unanchored regex, allowing attackers to bypass MetaIssuer URL validation and trigger SSRF to arbitrary internal services. Since the SSRF only can trigger GET requests, the request cannot mutate state. The response from the GET request is not returned to the caller so data exfiltration is not possible. A malicious actor could attempt to probe an internal network through Blind SSRF. This vulnerability is fixed in 1.8.5.

• CWE-918

• https://github.com/sigstore/fulcio/commit/eaae2f2be56df9dea5f9b439ec81bedae4c0978dPatch
• https://github.com/sigstore/fulcio/security/advisories/GHSA-59jp-pj84-45mrExploit, Vendor Advisory

Published

Jan 12, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-22767Dell AppSync, version(s) 4.6.0, contain(s) an UNIX Symbolic …7.3
• CVE-2026-22768Dell AppSync, version(s) 4.6.0, contain(s) an Incorrect Perm…7.3
• CVE-2026-22769Dell RecoverPoint for Virtual Machines, versions prior to 6.…10
• CVE-2026-2277The rexCrawler plugin for WordPress is vulnerable to Reflect…6.1
• CVE-2026-22770ImageMagick is free and open-source software used for editin…9.8
• CVE-2026-22771Envoy Gateway is an open source project for managing Envoy P…8.8
• CVE-2026-22773vLLM is an inference and serving engine for large language m…7.5
• CVE-2026-22774Svelte devalue is a JavaScript library that serializes value…7.5
• CVE-2026-22775Svelte devalue is a JavaScript library that serializes value…7.5
• CVE-2026-22776cpp-httplib is a C++11 single-file header-only cross platfor…7.5
• CVE-2026-22777ComfyUI-Manager is an extension designed to enhance the usab…7.5
• CVE-2026-22778vLLM is an inference and serving engine for large language m…9.8