Medium [CVE-2026-49478] Server-Side Request Forgery and Kubernetes ServiceAccount token leakage
This medium-severity Red Hat Linux advisory covers CVE-2026-49478 affecting Red Hat Advanced Cluster Security 4.9, Red Hat Advanced Cluster Security for Kubernetes 4.10, Assisted Installer for Red Hat OpenShift Container Platform 2.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Summary
Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity.
Versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a malicious or compromised issuer to perform blind SSRF, substitute and cache malicious JWKS keys, or disclose ServiceAccount tokens to external hosts.
Version 1.8.6 blocks cross-host redirects, restricts token injection, and restricts local token loading. No known workarounds are available.
A flaw was found in Fulcio's OpenID Connect (OIDC) Discovery client. This vulnerability allows a remote attacker to perform Server-Side Request Forgery (SSRF) by redirecting discovery requests to internal systems.
Additionally, an attacker can manipulate the JSON Web Key Set (JWKS) Uniform Resource Identifier (URI) to poison the verifier cache with malicious keys, enabling the validation of attacker-controlled signatures.
Furthermore, the flaw can lead to the leakage of Kubernetes ServiceAccount tokens to third-party hosts through cross-host redirects or misconfigured MetaIssuers, potentially exposing sensitive cluster credentials. Exploitation requires a compromised or malicious OIDC issuer already trusted in the Fulcio configuration.
Is CVE-2026-49478 exploited?
No exploitation is reported in the sources VulniPulse tracks: CVE-2026-49478 is not in the CISA KEV catalog (checked ) and this advisory does not report exploitation. That is not proof the vulnerability cannot be exploited.
How do I fix CVE-2026-49478?
Upgrade to a fixed release named by Red Hat:
- advanced-cluster-security/rhacs-main-rhel8:1785413210
- advanced-cluster-security/rhacs-main-rhel8:1785420959
- RHSA-2026:48872
- RHSA-2026:48913
Confirm against the vendor advisory before you patch.
- 1.8.5
Official advisory · high-confidence parse· fetched 12 days ago·verify at source
- advanced-cluster-security/rhacs-main-rhel8:1785413210
- advanced-cluster-security/rhacs-main-rhel8:1785420959
- RHSA-2026:48872
- RHSA-2026:48913
Official advisory · high-confidence parse· fetched 12 days ago·verify at source
Mitigation checklist
- Upgrade to Fulcio v1.8.6 or later. No workaround is available.
Official advisory · high-confidence parse· fetched 12 days ago·verify at source
Get an email when Red Hat RHEL & SELinux publishes the next one.
See Red Hat RHEL & SELinux's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
More Red Hat Linux advisories
- CVE-2026-111497Oct 22, 2026Out-of-Bounds Write in Google Brotli Decoder
- CVE-2026-109619Oct 21, 2026fatal error handling retains stale request state leading to use-after-free
- CVE-2026-109618Oct 21, 2026OOM bailout during request parsing leads to memory corruption and RCE
- CVE-2026-48710May 26, 2026Security restriction bypass via malformed HTTP Host header
- CVE-2026-119977Oct 31, 2026Arbitrary code execution via predictable upgrade staging paths
- CVE-2026-97229Oct 13, 2026integer overflow issue in CI/CD regular expression compiler
iPhone and Android apps · New on the App Store
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.