Security readout for executives and security teams
Plain-English summary
CVE-2026-22772 affects Sigstore Fulcio before version 1.8.5. A validation flaw can let an unauthenticated attacker make Fulcio send blind GET requests to internal services. The advisory says responses are not returned and state-changing requests are not possible, limiting impact to internal network probing.
Executive priority
Treat as a moderate-priority infrastructure fix. It does not indicate data theft or system takeover in the provided sources, but it can expose internal network structure and should be remediated promptly in internet-facing or shared environments.
Technical view
Fulcio’s metaRegex() used unanchored regular expressions for MetaIssuer URL validation. This can allow a regex bypass and server-side request forgery to arbitrary internal services. The issue is classified as CWE-918 with CVSS 3.1 score 5.8. It is fixed in Fulcio 1.8.5.
Likely exposure
Exposure is limited to organizations running Sigstore Fulcio versions earlier than 1.8.5, especially deployments reachable by untrusted users or integrated into public certificate workflows.
Exploitation context
The source bundle does not report known active exploitation, and KEV status is false. Exploitation is described as blind SSRF using GET requests only, with no response data returned to the caller.
Researcher notes
Key constraints matter: GET-only SSRF, blind behavior, and no response exfiltration according to the advisory. Validate affected versions and patch status rather than assuming broader Sigstore impact. No public exploit status is provided in the source bundle.
Mitigation direction
- Upgrade Fulcio to version 1.8.5 or later.
- Review the GitHub advisory for vendor guidance and deployment-specific notes.
- Restrict network egress from Fulcio where operationally feasible.
- Monitor Fulcio and internal service logs for unusual outbound GET activity.
Validation and detection
- Inventory Fulcio deployments and record running versions.
- Confirm no production Fulcio instance is below 1.8.5.
- Review configuration using MetaIssuer URL validation paths.
- Check logs for unexpected internal requests originating from Fulcio.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-918: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCloud metadata behavior lookup
The CVE wording references SSRF or metadata access, so cloud discovery and credential material review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-22772 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N3.91.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.8MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/sigstore/fulcio/security/advisories/GHSA-59jp-pj84-45mrCVE reference · x_refsource_CONFIRM
- https://github.com/sigstore/fulcio/commit/eaae2f2be56df9dea5f9b439ec81bedae4c0978dCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Server-Side Request Forgery (SSRF)
Server-Side Request Forgery (SSRF) represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.