GO-2026-4355

vendorUSosv

Rekor affected by Server-Side Request Forgery (SSRF) via provided public key URL in github.com/sigstore/rekor

view advisory published 2026-02-02Licence: per source

Rekor affected by Server-Side Request Forgery (SSRF) via provided public key URL in github.com/sigstore/rekor

01

describes (1)

Related CVEs.

IDseverity exploitable
CVE-2026-24117US——
Rekor is a software supply chain transparency log. In versions 1.4.3 and below, attackers can trigger SSRF to arbitrary internal services because /api/v1/index/retrieve supports re…
02

references

External citations — patches, advisories, analysis.

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan