CVE-2026-24117
BaseFortify
Publication date: 2026-01-22
Last updated on: 2026-02-02
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linuxfoundation | rekor | to 1.5.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows an attacker to perform Blind SSRF to probe internal networks but does not allow data exfiltration or state mutation. Therefore, it does not directly lead to unauthorized data access or leakage that would impact compliance with standards like GDPR or HIPAA. However, the ability to probe internal services could potentially be used as part of a larger attack chain, so organizations should consider this risk in their overall security posture.
Can you explain this vulnerability to me?
This vulnerability is a Server-Side Request Forgery (SSRF) in Rekor versions 1.4.3 and below. It allows attackers to make the server send GET requests to arbitrary internal services by using the /api/v1/index/retrieve endpoint, which retrieves a public key via a user-provided URL. Although the SSRF can only trigger GET requests and does not return the response to the attacker, it enables probing of internal networks through Blind SSRF.
How can this vulnerability impact me? :
The vulnerability allows an attacker to probe internal network services by making the server send GET requests to internal URLs. While it cannot mutate state or exfiltrate data directly, it could be used to map internal network structure or discover internal services, potentially aiding further attacks.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability immediately, upgrade Rekor to version 1.5.0 or later. As a workaround, disable the search endpoint by setting the option --enable_retrieve_api=false.