CVE-2026-22772CWE-918

Fulcio vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass

Medium · published January 12, 2026

CVSS v3.1
5.8
EPSS
0%
Percentile
13.2
In the wild
Unconfirmed
What it is

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.5, Fulcio's metaRegex() function uses unanchored regex, allowing attackers to bypass MetaIssuer URL validation and trigger SSRF to arbitrary internal services. Since the SSRF only can trigger GET requests, the request cannot mutate state. The response from the GET request is not returned to the caller so data exfiltration is not possible. A malicious actor could attempt to probe an internal network through Blind SSRF. This vulnerability is fixed in 1.8.5.

The record
Technical detail
CVSS v3.1
5.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00232 · 13.2th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-01-12T20:58Z
EPSS history
Timeline
  • 12 JAN 20:58Z
    Fulcio vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass
    cvelistv5