CVE-2026-24117 Rekor affected by Server-Side Request Forgery (SSRF) via provided public key URL
Attackers can perform blind SSRF to probe internal networks via the public key retrieval endpoint in Rekor.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-24117?
CVE-2026-24117 is a medium-severity server-side request forgery vulnerability in sigstore rekor, published on 22 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Rekor is a software supply chain transparency log. In versions 1.4.3 and below, attackers can trigger SSRF to arbitrary internal services because /api/v1/index/retrieve supports retrieving a public key via user-provided URL. Since the SSRF only can trigger GET requests, the request cannot mutate state. The response from the GET request is not returned to the caller so data exfiltration is not possible. A malicious actor could attempt to probe an internal network through Blind SSRF. The issue has been fixed in version 1.5.0. To workaround this issue, disable the search endpoint with --enable_retrieve_api=false.
Weakness: CWE-918
Which versions are affected by CVE-2026-24117?
3 open source packages ship an affected version, including github.com/sigstore/rekor. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/sigstore/rekor Go | All versions | 1.5.0 |
github.com/sigstore/rekor Go | All versions | 1.5.0 |
github.com/sigstore/rekor Go | All versions | 1.5.0 |
Products include Linuxfoundation Rekor.
How do I fix CVE-2026-24117?
Upgrade github.com/sigstore/rekor to 1.5.0 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-24117 being exploited?
There is no known exploitation of CVE-2026-24117 in the wild and no public exploit code.
Other vulnerabilities in sigstore rekor
Sources
Also known as AZL-76446, AZL-76542, AZL-76547, AZL-76608, CLEANSTART-2026-CM50083, CLEANSTART-2026-WK71465 and 27 more.