5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-24117

CVE-2026-24117: Rekor affected by Server-Side Request Forgery (SSRF) via provided public key URL

Rekor is a software supply chain transparency log. In versions 1.4.3 and below, attackers can trigger SSRF to arbitrary internal services because /api/v1/index/retrieve supports retrieving a public key via user-provided URL. Since the SSRF only can trigger GET requests, the request cannot mutate state. The response from the GET request is not returned to the caller so data exfiltration is not possible. A malicious actor could attempt to probe an internal network through Blind SSRF. The issue has been fixed in version 1.5.0. To workaround this issue, disable the search endpoint with --enable_retrieve_api=false.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-24117

CVE-2026-24117:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/sigstore/rekor	go	<= 1.4.3	1.5.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) located in Rekor's /api/v1/index/retrieve API endpoint. The root cause was that the server would fetch a public key from a user-provided URL, without proper validation of the URL's destination.

The analysis of the patch commit 60ef2bceba192c5bf9327d003bceea8bf1f8275f reveals the exact location of the vulnerability. The function api.SearchIndexHandler in pkg/api/index.go was responsible for handling the API request. It previously used a utility function, util.FileOrURLReadCloser, to retrieve the public key. This utility would make an HTTP GET request if a URL was provided in the request parameters (params.Query.PublicKey.URL).

The patch remediates this vulnerability by removing the capability to fetch keys by URL entirely from the server-side logic. The api.SearchIndexHandler was modified to only process public keys provided directly in the request content (params.Query.PublicKey.Content). The URL field was also removed from the API definition (openapi.yaml) and related data structures.

Consequently, two functions are identified as key runtime indicators for this vulnerability:

api.SearchIndexHandler: The entry point for the vulnerable operation, which takes the user-supplied URL.
util.FileOrURLReadCloser: The function that executes the outbound HTTP request, which constitutes the SSRF. Both would be present in a stack trace during exploitation.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.