CVE-2026-22772: 
NixOS vulnerability analysis and mitigation

CVE-2026-22772 is a Server-Side Request Forgery (SSRF) vulnerability in Fulcio, the Sigstore certificate authority for issuing code signing certificates via OpenID Connect (OIDC). The flaw exists in the metaRegex() function in pkg/config/config.go, which uses unanchored regular expressions, allowing attackers to bypass MetaIssuer URL validation and trigger SSRF against arbitrary internal services. It affects all Fulcio versions up to and including 1.8.4, and was disclosed on January 12, 2026, with a fix released in version 1.8.5. The CVSS v3.1 base score is 5.8 (Moderate) per the GitHub Advisory, or 5.3 (Medium) per NVD (GitHub Advisory, GHSA Database).

The root cause is CWE-918 (Server-Side Request Forgery): the metaRegex() function in pkg/config/config.go (lines 143–156) compiles a regex from the MetaIssuer URL without prepending ^ or appending $ anchors. Because Go's regexp.MatchString() performs substring matching, an attacker can craft a JWT iss claim such as https://attacker.com/path/https://oidc.eks.x.amazonaws.com/id/y, which embeds a legitimate-looking MetaIssuer URL as a substring. Fulcio's GetIssuer() matches this against MetaIssuer patterns, then calls oidc.NewProvider() with the attacker-controlled URL, causing an HTTP GET request to the attacker's server. The attacker's OIDC discovery document can then point jwks_uri to an internal service, causing Fulcio to issue a follow-up GET to that internal endpoint — completing the SSRF chain. No authentication is required to trigger this (GitHub Advisory, Fix Commit).

Exploitation enables Blind SSRF against any service reachable from Fulcio's network, including cloud metadata endpoints (e.g., 169.254.169.254), internal Kubernetes APIs, and other internal microservices. Because the SSRF is limited to GET requests and responses are not returned to the caller, direct data exfiltration and state mutation are not possible; however, an attacker can perform internal network reconnaissance to map accessible services and identify targets for further attacks. All Fulcio deployments using MetaIssuers are affected (GitHub Advisory, GHSA Database).

A proof-of-concept exploit path is documented in the official security advisory, demonstrating the full attack chain from crafted JWT to SSRF. No evidence of in-the-wild exploitation has been reported. The EPSS score is approximately 0.012% (2nd percentile), indicating low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (GitHub Advisory, GHSA Database).

1. Identify a vulnerable Fulcio deployment: Confirm the target is running Fulcio ≤ 1.8.4 with MetaIssuers configured (e.g., AWS EKS, GKE, Azure AKS OIDC issuers).
2. Craft a malicious JWT: Create a JWT with an iss (issuer) claim that embeds a legitimate MetaIssuer URL as a substring of an attacker-controlled URL, e.g., https://attacker.com/path/https://oidc.eks.us-west-2.amazonaws.com/id/B02C93B6A2D30341AD01E1B6D48164CB.
3. Submit the JWT to Fulcio: Send a certificate signing request to Fulcio's API using the crafted JWT as the OIDC token.
4. Trigger regex bypass: Fulcio's GetIssuer() calls metaRegex(), which matches the embedded legitimate URL as a substring due to missing anchors, accepting the attacker's URL as valid.
5. Force OIDC provider fetch: Fulcio calls oidc.NewProvider() with the attacker-controlled URL, sending a GET request to https://attacker.com/path/.../.well-known/openid-configuration.
6. Return malicious OIDC discovery document: The attacker's server responds with an OIDC discovery document where jwks_uri points to an internal target (e.g., http://169.254.169.254/latest/meta-data/ or http://kubernetes.default.svc/api/v1/namespaces).
7. Achieve Blind SSRF: Fulcio fetches the jwks_uri, sending a GET request to the internal service, enabling network reconnaissance (GitHub Advisory, GHSA Database).

• Network: Unexpected outbound HTTP GET requests from the Fulcio service to cloud metadata endpoints (e.g., 169.254.169.254), internal Kubernetes API server addresses, or unusual external domains not matching configured OIDC issuers.
• Network: Outbound connections from Fulcio to attacker-controlled domains that embed legitimate MetaIssuer URLs in their path (e.g., https://attacker.com/path/https://oidc.eks.*.amazonaws.com/...).
• Logs: Fulcio access logs showing certificate signing requests with iss JWT claims containing URLs that are not direct matches to configured MetaIssuer patterns but include them as substrings.
• Logs: HTTP client logs or network proxy logs showing Fulcio fetching .well-known/openid-configuration or JWKS endpoints from unexpected hosts.
• Process/Application: Errors or timeouts in Fulcio logs related to OIDC provider initialization for unexpected issuer URLs (GitHub Advisory).

Upgrade Fulcio to version 1.8.5 or later, which fixes the issue by adding ^ and $ anchors to the compiled regex in metaRegex() (now renamed MetaRegex()), preventing substring matching. There are no effective configuration-based workarounds — the advisory explicitly states that manually adding anchors to MetaIssuer configuration URLs will be escaped before regex compilation and will not mitigate the issue. As interim measures for environments where immediate patching is not possible, implement network segmentation to restrict outbound connections from the Fulcio service and apply firewall rules to block access to sensitive internal endpoints such as cloud metadata services and Kubernetes APIs (GitHub Advisory, Fix Commit).

The vulnerability was reported by security researcher morwn and published by Hayden-IO (Hayden Blauzvern) on January 12, 2026. Red Hat issued multiple errata (RHSA-2026:2136, RHSA-2026:2144, RHSA-2026:2924) addressing this CVE in their products, and SUSE, openSUSE, and Amazon Linux 2 also released updates. Tenable published Nessus detection plugins (IDs 299709 and 301024). Coverage appeared across Linux security news outlets and vulnerability aggregators, reflecting broad ecosystem attention given Fulcio's role in the software supply chain security toolchain (GitHub Advisory, Red Hat RHSA-2026:2136).