Attack Chain

1. An attacker either controls a malicious OIDC issuer or compromises a legitimate one configured for Fulcio.
2. Fulcio, during its OIDC discovery process, initiates a request to fetch metadata (/.well-known/openid-configuration) from the attacker-controlled OIDC issuer.
3. The malicious OIDC issuer responds with an HTTP 3xx redirect to an internal IP address or hostname within Fulcio's network, such as the Kubernetes API server (https://kubernetes.default.svc), triggering a blind SSRF.
4. Simultaneously, the attacker-controlled issuer can provide a jwks_uri in its discovery response that points to an endpoint under the attacker's control.
5. Fulcio, following the malicious jwks_uri, fetches the attacker's JSON Web Key Set (JWKS) and caches it, effectively poisoning its internal verifier cache.
6. With the poisoned cache, the attacker can now forge signatures for software artifacts that Fulcio will validate as legitimate, bypassing critical integrity checks in the supply chain.
7. During these redirected HTTP requests and JWKS fetches, Fulcio inappropriately attaches its mounted Kubernetes ServiceAccount token to outbound requests directed towards the external, attacker-controlled hosts.
8. This leakage exposes the Kubernetes ServiceAccount token to the attacker, potentially enabling further reconnaissance, privilege escalation, and direct access to the Kubernetes cluster API and its resources.

Impact

The identified vulnerabilities have severe consequences across several domains. The blind SSRF allows attackers to probe and potentially interact with internal network services and infrastructure that would otherwise be inaccessible, potentially revealing sensitive information or enabling further internal attacks. JWKS substitution directly compromises the integrity verification process, allowing attackers to sign and distribute malicious software that appears legitimate, undermining the trust model of Sigstore and supply chain security. Most critically, the leakage of Kubernetes ServiceAccount tokens provides attackers with credentials that can be used to gain unauthorized access to the Kubernetes cluster. This can lead to full cluster compromise, data exfiltration, resource manipulation, and deployment of malicious workloads, affecting a wide range of organizations using Fulcio for artifact signing and verification, particularly those deployed within Kubernetes environments.

Recommendation

• Upgrade immediately: Patch affected Sigstore Fulcio instances to version 1.8.6 or newer to address CVE-2026-49478.
• Monitor application logs: Review application logs for Fulcio's OIDC discovery process for unusual HTTP redirects or fetches from unexpected jwks_uri endpoints, although the SSRF is blind and direct detection may be challenging.
• Review Kubernetes ServiceAccount usage: Audit the permissions granted to the Kubernetes ServiceAccounts used by Fulcio to ensure they adhere to the principle of least privilege, minimizing the impact of potential token leakage as described in CVE-2026-49478.