CVE-2026-24117: 
Datadog Agent vulnerability analysis and mitigation

CVE-2026-24117 is a Server-Side Request Forgery (SSRF) vulnerability in Sigstore's Rekor, a software supply chain transparency log. The /api/v1/index/retrieve endpoint accepts a user-provided URL to retrieve a public key, allowing unauthenticated attackers to trigger GET requests to arbitrary internal services. All Rekor versions up to and including 1.4.3 are affected; the issue was disclosed and patched on January 22, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) (Github Advisory, Sigstore Advisory).

The root cause is improper server-side request handling (CWE-918): the SearchIndexHandler function in pkg/api/index.go passed the caller-supplied URL directly to util.FileOrURLReadCloser, which issued an outbound HTTP GET without any allowlist or destination validation. Because the SSRF is limited to GET requests, state mutation is not possible, and since the HTTP response body is not returned to the caller, direct data exfiltration is also prevented — making this a Blind SSRF. The fix (commit 60ef2bc) removes URL-based public key fetching from the server entirely, resolving the issue at the API level rather than through filtering (Sigstore Advisory, Patch Commit).

An unauthenticated remote attacker can use the vulnerable endpoint to probe internal network infrastructure accessible from the Rekor server, including cloud instance metadata services (e.g., 169.254.169.254), internal Kubernetes API servers, and any service reachable from Fulcio's network. While direct data exfiltration is not possible due to the response not being returned to the caller, successful probing can reveal the existence and reachability of internal services, potentially exposing sensitive credentials or service tokens through side-channel timing or error-based inference. Integrity and availability are not directly impacted (Github Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The vulnerability requires no authentication, no user interaction, and no special privileges, making it trivially accessible to any network-reachable attacker. The EPSS score is approximately 0.016% (4th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory, Feedly).

1. Identify target: Locate a publicly or internally accessible Rekor instance running version 1.4.3 or earlier. Rekor typically listens on port 3000 by default.
2. Confirm endpoint availability: Verify the /api/v1/index/retrieve search endpoint is enabled (it is enabled by default unless --enable_retrieve_api=false is set).
3. Craft SSRF payload: Construct a POST request to /api/v1/index/retrieve with a JSON body specifying a publicKey object containing a url field pointing to an internal target, such as the cloud metadata endpoint:

{
  "query": {
    "publicKey": {
      "format": "x509",
      "url": "http://169.254.169.254/latest/meta-data/"
    }
  }
}

4. Infer internal service existence: Observe differences in response time or error messages to determine whether the internal target is reachable (Blind SSRF). Repeat with different internal IP addresses and ports to map the internal network.
5. Target sensitive endpoints: Probe known internal endpoints such as Kubernetes API (https://kubernetes.default.svc/) or internal service registries to enumerate accessible services (Sigstore Advisory).

• Network: Outbound GET requests from the Rekor server process to internal IP ranges (e.g., 169.254.169.254, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or Kubernetes API server addresses; unusual DNS lookups originating from the Rekor host for internal hostnames.
• Logs: Repeated POST requests to /api/v1/index/retrieve in Rekor access logs containing url fields in the request body pointing to internal or metadata addresses; HTTP client errors or timeouts logged by Rekor when attempting to fetch attacker-specified URLs.
• Process: Unexpected outbound TCP connections from the Rekor server process to ports 80, 443, or 8080 on internal network hosts not normally contacted by the service.

Upgrade Rekor to version 1.5.0 or later, which removes URL-based public key fetching from the server entirely — note this is a breaking change to the search API as URL-based lookups are fully disabled (Rekor v1.5.0 Release). For deployments that cannot be upgraded immediately, disable the vulnerable endpoint by starting the Rekor server with the flag --enable_retrieve_api=false. Additionally, implement network egress controls to restrict the Rekor server from making outbound connections to internal metadata services and private IP ranges as a defense-in-depth measure (Sigstore Advisory).

The vulnerability was reported by security researcher 1seal and published by Hayden-IO on behalf of the Sigstore project on January 22, 2026. The fix was noted as a breaking API change, with the maintainers acknowledging the experimental status of the affected feature and offering to discuss alternatives for users who relied on URL-based public key lookups (Sigstore Advisory, Patch Commit).