5.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-22772

CVE-2026-22772: Fulcio vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.5, Fulcio's metaRegex() function uses unanchored regex, allowing attackers to bypass MetaIssuer URL validation and trigger SSRF to arbitrary internal services. Since the SSRF only can trigger GET requests, the request cannot mutate state. The response from the GET request is not returned to the caller so data exfiltration is not possible. A malicious actor could attempt to probe an internal network through Blind SSRF. This vulnerability is fixed in 1.8.5.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-22772

CVE-2026-22772:

5.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/sigstore/fulcio	go	<= 1.8.4	1.8.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) in Fulcio, identified as GHSA-59jp-pj84-45mr. The root cause is the use of an unanchored regular expression for validating OIDC issuer URLs from JWT tokens.

The analysis of the patch commit eaae2f2be56df9dea5f9b439ec81bedae4c0978d reveals the core of the issue. The function metaRegex, present in both the pkg/config/config.go and pkg/identity/base/issuer.go files, was responsible for creating a regex pattern from a given issuer string. This function failed to add start (^) and end ($) anchors to the generated regex.

Go's regexp.MatchString() function performs substring matching by default. Without anchors, an attacker could provide a malicious URL that contains a valid issuer pattern as a substring (e.g., https://attacker.com/?p=https://valid-issuer.com). The regex would incorrectly match, causing Fulcio to trust the attacker's URL.

The exploit flow involves Fulcio's GetIssuer and baseIssuer.Match functions, which used the vulnerable metaRegex function. When processing a JWT, these functions would match the malicious iss claim, leading the oidc.NewProvider() function to send a request to the attacker-controlled server. The attacker could then redirect Fulcio to an internal service by manipulating the OIDC discovery response, thus achieving a blind SSRF.

The patch remediates this by:

Consolidating the metaRegex logic into a single public function config.MetaRegex.
Adding ^ and $ anchors to the regex pattern to ensure it matches the entire URL string, not just a substring.

The identified vulnerable functions are the original metaRegex functions that created the flawed regex, and the GetIssuer and Match methods that used this regex to validate potentially malicious input.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.