CVE-2026-24117: falha de média gravidade em sigstore rekor
Rekor affected by Server-Side Request Forgery (SSRF) via provided public key URL
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.4%
Rekor is a software supply chain transparency log. In versions 1.4.3 and below, attackers can trigger SSRF to arbitrary internal services because /api/v1/index/retrieve supports retrieving a public key via user-provided URL. Since the SSRF only can trigger GET requests, the request cannot mutate state. The response from the GET request is not returned to the caller so data exfiltration is not possible. A malicious actor could attempt to probe an internal network through Blind SSRF. The issue has been fixed in version 1.5.0. To workaround this issue, disable the search endpoint with --enable_retrieve_api=false.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
sigstore · rekorCVEs relacionadas — sigstore rekor
No mesmo produto, das mais perigosas para as menos.
CVE-2023-30551HIGHRekor's compressed archives can result in OOM conditionsEPSS 1.1%CVE-2023-33199MEDIUMmalformed proposed intoto v0.0.2 entries can cause a panic in RekorEPSS 0.7%CVE-2026-48702HIGHRekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing LogicEPSS 0.5%CVE-2026-23831MEDIUMRekor COSE v0.0.1 Canonicalize crashes when passed empty MessageEPSS 0.4%