Description

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a malicious or compromised issuer to perform blind SSRF, substitute and cache malicious JWKS keys, or disclose ServiceAccount tokens to external hosts. Version 1.8.6 blocks cross-host redirects, restricts token injection, and restricts local token loading. No known workarounds are available.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.7",
  "pubDate": "2026-08-13T13:19:09.790Z",
  "pubdate": "2026-08-13T13:19:09.790Z",
  "executiveSummary": "Fulcio versions through 1.8.5 are susceptible to improper handling of cross-host redirects and un-restricted Kubernetes ServiceAccount token attachment during the OpenID Connect (OIDC) discovery phase. This vulnerability exposes the affected systems to blind Server-Side Request Forgery (SSRF), malicious JSON Web Key Set (JWKS) key substitution and caching, as well as the unauthorized disclosure of sensitive Kubernetes ServiceAccount tokens to external, untrusted hosts. The core vulnerability empowers a malicious or compromised OIDC issuer to manipulate the discovery process and redirect outbound requests maliciously. Consequently, an attacker possessing a compromised or malicious issuer capability can exfiltrate sensitive cluster identity tokens or poison the internal cryptographic material cache. Exploitation relies on the target's interaction with a malicious OIDC issuer endpoint that issues cross-host redirect sequences or induces unauthorized token leakage. Because no workarounds exist, remediation strictly requires upgrading the software to the patched version. The risk implication is severe, potentially compromising the integrity and confidentiality of the certificate authority and associated cluster environments.",
  "technicalDetails": "The vulnerability resides within the OpenID Connect (OIDC) discovery mechanism of Fulcio, specifically affecting versions through 1.8.5. The root cause of the flaw stems from two primary behavioral deficiencies: the improper adherence to cross-host HTTP redirects during OIDC discovery and the indiscriminate attachment of Kubernetes ServiceAccount tokens to outbound discovery requests destined for external entities. When Fulcio initiates communication with an OIDC issuer for discovery purposes, the vulnerable component fails to validate whether redirect directives target the original host or an entirely distinct external domain. Furthermore, the application appends sensitive Kubernetes ServiceAccount tokens to these outbound requests regardless of the destination host's boundary, violating the principle of least privilege regarding token scoping and transmission.\nThe step-by-step attack flow proceeds as follows. First, an attacker sets up or compromises an OIDC issuer interacting with the vulnerable Fulcio instance. Second, the Fulcio certificate authority initiates an OIDC discovery request toward the malicious issuer. Third, the malicious issuer responds with an HTTP redirect pointing to an external, attacker-controlled host or a target internal resource. Fourth, because Fulcio improperly follows cross-host redirects, it follows the redirection instruction while maintaining the transmission of the attached Kubernetes ServiceAccount token, or it issues subsequent requests to the redirected endpoint containing sensitive authentication material. Fifth, upon reaching the external or unintended host, the malicious server captures the leaked ServiceAccount token, facilitating unauthorized access or privilege escalation within the Kubernetes cluster. Alternatively, the malicious endpoint can return crafted JWKS payloads designed to be substituted and cached by Fulcio, leading to compromised signature verification processes and unauthorized code signing certificate issuance. The vulnerable component lacks authentication or privilege requirements from the attacker's perspective beyond the ability to act as a configured or discoverable OIDC issuer interacting with the target Fulcio deployment. Network exposure is defined by Fulcio's outbound network capabilities used to query external OIDC discovery documents and endpoints."
}