Vulnerability Database - OSV

CVE-2026-49478

github.com/sigstore/fulcio

Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage 13 Aug

Fix available
Severity - 8.7 (High)

CLEANSTART-2026-IH01456

CleanStart/cosign
CleanStart/kyverno
CleanStart/tekton-chains
CleanStart/tekton-chains-fips
CleanStart/tkn

Security fix for CVE-2026-49478 applied in: cosign 2.6.5-r0, cosign 3.1.1-r1, kyverno 1.16.4-r3, kyverno 1.17.2-r2, kyverno 1.18.1-r1, kyverno 1.18.1-r2, tekton-chains 0.25.2-r1, tekton-chains 0.26.5-r1, tekton-chains-fips 0.24.0-r1, tekton-chains-fips 0.25.2-r1, tekton-chains-fips 0.26.5-r1, tkn 0.42.2-r1, tkn 0.43.2-r1, tkn 0.44.2-r1 18 Sep

Fix available

CGA-f5fh-wwx9-c64v

Chainguard/kyverno-1.17
Wolfi/kyverno-1.17

See record for full details 15 Sep

Fix available
Severity - 8.7 (High)

CGA-8v7w-3jx3-c9f4

Chainguard/kyverno-cli-1.17
Wolfi/kyverno-cli-1.17

See record for full details 15 Sep

Fix available
Severity - 8.7 (High)

CGA-gx98-8x97-2fr5

Chainguard/kyverno-init-container-1.18
Wolfi/kyverno-init-container-1.18

See record for full details 15 Sep

Fix available
Severity - 8.7 (High)

CGA-gqm3-26cq-m4w6

Chainguard/ratify-licensechecker-compat
Wolfi/ratify-licensechecker-compat

See record for full details 15 Sep

Fix available
Severity - 8.7 (High)

CGA-h5fg-jgfc-wwg2

Chainguard/kyverno-1.17
Wolfi/kyverno-1.17

See record for full details 15 Sep

Fix available
Severity - 8.7 (High)

DEBIAN-CVE-2026-49478

Debian:13/golang-github-sigstore-fulcio
Debian:14/golang-github-sigstore-fulcio

See record for full details 13 Aug

Fix available
Severity - 8.7 (High)

UBUNTU-CVE-2026-49478

Ubuntu:26.04:LTS/golang-github-sigstore-fulcio

See record for full details 13 Aug

No fix available
Severity - 8.7 (High)

MINI-866f-hr64-v57g

MinimOS/docker-scout-1.23

See record for full details 04 Aug

No fix available

MINI-ghvq-cm48-g2xq

MinimOS/buildah

See record for full details 30 Jul

Fix available

MINI-m5gq-6r9h-p4g2

MinimOS/buildah-fips

See record for full details 30 Jul

Fix available

MINI-jmj9-9wpp-mpwm

MinimOS/prometheus-podman-exporter-fips

See record for full details 24 Jul

Fix available

MINI-52mv-fwp9-55r8

MinimOS/prometheus-podman-exporter

See record for full details 22 Jul

Fix available

MINI-5v8x-5fmm-jc4g

MinimOS/kyverno-notation-aws-fips

See record for full details 22 Jul

Fix available

MINI-65qv-qr7f-wgwh

MinimOS/kyverno-notation-aws

See record for full details 22 Jul

Fix available