--- id: CVE-2026-22772 title: >- fulcio: Fulcio: Server-Side Request Forgery (SSRF) via unanchored regex in MetaIssuer URL validation (CVE-2026-22772) summary: >- A flaw was found in Fulcio, a certificate authority for issuing code signing certificates. A remote attacker could exploit this by bypassing MetaIssuer URL validation due to unanchored regular expressions (regex) in the `metaRegex()` funct… severity: medium cvss: 5.8 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N' cvssSource: vendor cwe: CWE-918 vendor: Red Hat product: Red Hat Openshift Data Foundation 4.22 affected: - assisted_installer_for_red_hat_openshift_container_platform 2 - compliance_operator - confidential_compute_attestation - file_integrity_operator - kernel_module_management_operator_for_red_hat_openshift - logging_subsystem_for_red_hat_openshift - logical_volume_manager_storage - migration_toolkit_for_containers - migration_toolkit_for_virtualization - multiarch_tuning_operator - multicluster_engine_for_kubernetes - network_observability_operator - node_healthcheck_operator - openshift_api_for_data_protection - openshift_developer_tools_and_services - openshift_lightspeed - openshift_pipelines - openshift_serverless - openshift_service_mesh 2 - openshift_service_mesh 3 - power_monitoring_for_red_hat_openshift - advanced_cluster_management_for_kubernetes 2 - advanced_cluster_security 4 - ansible_automation_platform 2 - build_of_kueue - build_of_podman_desktop_tech_preview - certification_program_for_red_hat_enterprise_linux 9 - developer_hub - enterprise_linux 10 - enterprise_linux 8 - enterprise_linux 9 - enterprise_linux_ai_rhel_ai 3 - openshift_ai_rhoai - openshift_container_platform 4 - openshift_dev_spaces - openshift_gitops - openstack_platform 18.0 - quay 3 - web_terminal - security_profiles_operator patched: - openshift_data_foundation 4.22 - trusted_artifact_signer 1.2 - trusted_artifact_signer 1.3 published: '2026-01-12' updated: '2026-10-15' sourceUpdated: '2026-10-15T11:33:39+00:00' source: CSAF sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22772.json' references: - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22772.json - url: 'https://access.redhat.com/security/cve/CVE-2026-22772' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2428808' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-22772' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-22772' - url: >- https://github.com/sigstore/fulcio/commit/eaae2f2be56df9dea5f9b439ec81bedae4c0978d - url: 'https://github.com/sigstore/fulcio/security/advisories/GHSA-59jp-pj84-45mr' - url: 'https://access.redhat.com/errata/RHSA-2026:37387' - url: 'https://access.redhat.com/errata/RHSA-2026:2924' - url: 'https://access.redhat.com/errata/RHSA-2026:2922' - url: 'https://access.redhat.com/errata/RHSA-2026:2136' - url: 'https://access.redhat.com/errata/RHSA-2026:2144' - url: 'https://github.com/sigstore/fulcio' tags: - csaf - vex - red-hat - osv - go epss: 0.00232 epssPercentile: 0.13951 aliases: - GHSA-59jp-pj84-45mr - GO-2026-4311 ecosystem: go ingestedAt: '2026-09-12T03:13:01.755Z' --- ## Overview A flaw was found in Fulcio, a certificate authority for issuing code signing certificates. A remote attacker could exploit this by bypassing MetaIssuer URL validation due to unanchored regular expressions (regex) in the `metaRegex()` function. This vulnerability could lead to Server-Side Request Forgery (SSRF), allowing the attacker to probe internal network services. While the flaw only permits GET requests, preventing state changes or data exfiltration, it still poses a risk for internal network reconnaissance. ## Vendor advisories - **RHSA-2026:37387** · Red Hat · fixed in: Red Hat Openshift Data Foundation 4.22 · released 2026-07-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:37387) - **RHSA-2026:2924** · Red Hat · fixed in: Red Hat Trusted Artifact Signer 1.2 · released 2026-02-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:2924) - **RHSA-2026:2922** · Red Hat · fixed in: Red Hat Trusted Artifact Signer 1.2 · released 2026-02-18 · [advisory](https://access.redhat.com/errata/RHSA-2026:2922) - **RHSA-2026:2136** · Red Hat · fixed in: Red Hat Trusted Artifact Signer 1.3 · released 2026-02-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:2136) - **RHSA-2026:2144** · Red Hat · fixed in: Red Hat Trusted Artifact Signer 1.3 · released 2026-02-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:2144) - **Red Hat VEX** · Moderate · affected: Assisted Installer for Red Hat OpenShift Container Platform 2, Compliance Operator, Confidential Compute Attestation, File Integrity Operator, Kernel Module Management Operator for Red Hat Openshift, Logging Subsystem for Red Hat OpenShift, … · no fix planned: Red Hat Enterprise Linux 9, Assisted Installer for Red Hat OpenShift Container Platform 2, Compliance Operator, Confidential Compute Attestation, … · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22772.json) **fulcio: Fulcio: Server-Side Request Forgery (SSRF) via unanchored regex in MetaIssuer URL validation** — rated Moderate by Red Hat. Released 2026-01-12, updated 2026-10-15. Affected: - Assisted Installer for Red Hat OpenShift Container Platform 2 - Compliance Operator - Confidential Compute Attestation - File Integrity Operator - Kernel Module Management Operator for Red Hat Openshift - Logging Subsystem for Red Hat OpenShift - Logical Volume Manager Storage - Migration Toolkit for Containers - Migration Toolkit for Virtualization - Multiarch Tuning Operator - Multicluster Engine for Kubernetes - Network Observability Operator - Node HealthCheck Operator - OpenShift API for Data Protection - OpenShift Developer Tools and Services - OpenShift Lightspeed - OpenShift Pipelines - OpenShift Serverless - OpenShift Service Mesh 2 - OpenShift Service Mesh 3 - Power monitoring for Red Hat OpenShift - Red Hat Advanced Cluster Management for Kubernetes 2 - Red Hat Advanced Cluster Security 4 - Red Hat Ansible Automation Platform 2 - Red Hat Build of Kueue - Red Hat Build of Podman Desktop - Tech Preview - Red Hat Certification Program for Red Hat Enterprise Linux 9 - Red Hat Developer Hub - Red Hat Enterprise Linux 10 - Red Hat Enterprise Linux 8 - Red Hat Enterprise Linux 9 - Red Hat Enterprise Linux AI (RHEL AI) 3 - Red Hat OpenShift AI (RHOAI) - Red Hat OpenShift Container Platform 4 - Red Hat OpenShift Dev Spaces - Red Hat OpenShift GitOps - Red Hat OpenStack Platform 18.0 - Red Hat Quay 3 - Red Hat Web Terminal - Security Profiles Operator Fixed: - Red Hat Openshift Data Foundation 4.22 - Red Hat Trusted Artifact Signer 1.2 - Red Hat Trusted Artifact Signer 1.3 No fix planned: - Red Hat Enterprise Linux 9 - Assisted Installer for Red Hat OpenShift Container Platform 2 - Compliance Operator - Confidential Compute Attestation - File Integrity Operator - Kernel Module Management Operator for Red Hat Openshift - Logging Subsystem for Red Hat OpenShift - Logical Volume Manager Storage - Migration Toolkit for Containers - Migration Toolkit for Virtualization - Multiarch Tuning Operator - Multicluster Engine for Kubernetes - Network Observability Operator - Node HealthCheck Operator - OpenShift API for Data Protection - OpenShift Developer Tools and Services - OpenShift Lightspeed - OpenShift Pipelines - OpenShift Serverless - OpenShift Service Mesh 2 - OpenShift Service Mesh 3 - Power monitoring for Red Hat OpenShift - Red Hat Advanced Cluster Management for Kubernetes 2 - Red Hat Advanced Cluster Security 4 - Red Hat Ansible Automation Platform 2 - Red Hat Build of Kueue - Red Hat Build of Podman Desktop - Tech Preview - Red Hat Certification Program for Red Hat Enterprise Linux 9 - Red Hat Developer Hub - Red Hat Enterprise Linux 10 - Red Hat Enterprise Linux 8 - Red Hat Enterprise Linux AI (RHEL AI) 3 - Red Hat OpenShift AI (RHOAI) - Red Hat OpenShift Container Platform 4 - Red Hat OpenShift Dev Spaces - Red Hat OpenShift GitOps - Red Hat OpenStack Platform 18.0 - Red Hat Quay 3 - Red Hat Web Terminal - Security Profiles Operator Not affected: - Red Hat Openshift Data Foundation 4.22 - Red Hat Trusted Artifact Signer 1.2 - Red Hat Trusted Artifact Signer 1.3 ## Remediation Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/red_hat_openshift_data_foundation/4.22/html/updating_openshift_data_foundation/updating-ocs-to-odf_rhodf https://access.redhat.com/errata/RHSA-2026:37387 Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev Platform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization's software supply chain. For details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.2 … https://access.redhat.com/errata/RHSA-2026:2924 Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev Platform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization's software supply chain. For details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.2 … https://access.redhat.com/errata/RHSA-2026:2922 Workarounds / mitigations: - Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. ## Package advisory (CVE-2026-22772) Affected packages: - `github.com/sigstore/fulcio < 1.8.5` Patched in: - `github.com/sigstore/fulcio 1.8.5` Source: https://osv.dev/vulnerability/GHSA-59jp-pj84-45mr