Fulcio, a sigstore component acting as a certificate authority for OIDC-based code signing certificates, suffers from a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) in versions before 1.8.6. The vulnerability arises because these versions improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery. This behavior enables a malicious or compromised OIDC issuer to exploit blind SSRF, substitute and cache malicious JSON Web Key Sets (JWKS), or exfiltrate ServiceAccount tokens to external hosts. The issue is addressed in version 1.8.6 by blocking cross-host redirects, restricting token injection, and limiting local token loading.

Successful exploitation can lead to high impact including disclosure of Kubernetes ServiceAccount tokens, enabling further compromise of Kubernetes environments. Attackers can also perform blind SSRF attacks and substitute malicious JWKS keys, potentially undermining the integrity of code signing certificates issued by fulcio. The vulnerability does not affect availability but compromises confidentiality and integrity.

Upgrade fulcio to version 1.8.6 or later, which blocks cross-host redirects, restricts token injection, and limits local token loading to mitigate this vulnerability. No known workarounds are available. Applying the official fix is required to address the issue.