StackRadar

CVE-2026-49478

High

Advisory

Published 30 Jun 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
8.7
base score, highest
EPSS
0.002
7th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
34
of 17,781 indexed, latest versions
Container images
34
deployed by those charts
Fix available
1 of 1
affected package

Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage

Carried by container images the latest versions of 34 of 17,781 indexed charts deploy, on 34 images.

Affected packageAffected versionsFixed inImages
github.com/sigstore/fulciogolangv0.1.1, v0.1.2-0.20220114150912-86a2036f9bc7, v0.6.0, v1.3.1+7 more1.8.634
OSV records
GHSA-f5mr-q85p-6hh6
Also known as
GO-2026-5853

Charts affected

34 by stars
ChartLatestAffected imagesRadar Score
artifact-hubartifact-hubVerified publisher1.23.01 of 7See more

artifact-hub artifact-hub 1.23.0

1 of the 7 container images this version deploys carry CVE-2026-49478.

Container imageDigestPackageFixed in
artifacthub/tracker:v1.23.05368d21a6e5c
github.com/sigstore/fulcio@v1.7.1
1.8.6

Open the chart page →

10,755
falcofalcosecurity9.1.03 of 3See more

falco falcosecurity 9.1.0

3 of the 3 container images this version deploys carry CVE-2026-49478.

Container imageDigestPackageFixed in
falcosecurity/falco:0.44.1d0cfe422d6ac
github.com/sigstore/fulcio@v1.8.5
1.8.6
falcosecurity/falco-driver-loader:0.44.17df783d5269a
github.com/sigstore/fulcio@v1.8.5
1.8.6
falcosecurity/falcoctl:0.13.00eeb79adc580
github.com/sigstore/fulcio@v1.8.5
1.8.6

Open the chart page →

5,227
flux2fluxcd-community2.19.01 of 7See more

flux2 fluxcd-community 2.19.0

1 of the 7 container images this version deploys carry CVE-2026-49478.

Container imageDigestPackageFixed in
ghcr.io/fluxcd/source-controller:v1.9.22b8d06650a1b
github.com/sigstore/fulcio@v1.8.5
1.8.6

Open the chart page →

2,951
connaisseurconnaisseurVerified publisher2.12.01 of 2See more

connaisseur connaisseur 2.12.0

1 of the 2 container images this version deploys carry CVE-2026-49478.

Container imageDigestPackageFixed in
securesystemsengineering/connaisseur:v3.12.038918befbdad
github.com/sigstore/fulcio@v1.8.5
1.8.6

Open the chart page →

3,012
backstagerhdh-chartVerified publisher4.0.11 of 2See more

backstage rhdh-chart 4.0.1

1 of the 2 container images this version deploys carry CVE-2026-49478.

Container imageDigestPackageFixed in
quay.io/rhdh/rhdh-hub-rhel9:latest0b26358f5793
github.com/sigstore/fulcio@v1.7.1
1.8.6

Open the chart page →

1,339
snyk-monitorsnyk2.23.261 of 2See more

snyk-monitor snyk 2.23.26

1 of the 2 container images this version deploys carry CVE-2026-49478.

Container imageDigestPackageFixed in
snyk/kubernetes-monitor:2.23.26fb5ad76ce84e
github.com/sigstore/fulcio@v1.8.5
1.8.6

Open the chart page →

578
k8s-image-swapperestahnVerified publisher1.11.01 of 2See more

k8s-image-swapper estahn 1.11.0

1 of the 2 container images this version deploys carry CVE-2026-49478.

Container imageDigestPackageFixed in
ghcr.io/estahn/k8s-image-swapper:1.5.102f5be9cde5f9
github.com/sigstore/fulcio@v1.4.3
1.8.6

Open the chart page →

1,981
fulciosigstoreVerified publisher2.11.11 of 6See more

fulcio sigstore 2.11.1

1 of the 6 container images this version deploys carry CVE-2026-49478.

Container imageDigestPackageFixed in
ghcr.io/sigstore/scaffolding/createctconfig:v0.7.313a061734c5be
github.com/sigstore/fulcio@v1.7.1
1.8.6

Open the chart page →

3,490
finops-stackcert-managerVerified publisher0.0.56 of 12See more

finops-stack cert-manager 0.0.5

6 of the 12 container images this version deploys carry CVE-2026-49478.

Container imageDigestPackageFixed in
ghcr.io/kyverno/background-controller:v1.12.506ed5db6cd33
github.com/sigstore/fulcio@v1.4.3
1.8.6
ghcr.io/kyverno/cleanup-controller:v1.12.5b914032ef9ad
github.com/sigstore/fulcio@v1.4.3
1.8.6
ghcr.io/kyverno/kyverno:v1.12.5a61c7022abcf
github.com/sigstore/fulcio@v1.4.3
1.8.6
ghcr.io/kyverno/kyverno-cli:v1.12.5832a32779e6d
github.com/sigstore/fulcio@v1.4.3
1.8.6
ghcr.io/kyverno/kyvernopre:v1.12.563f7eaf5aa8a
github.com/sigstore/fulcio@v1.4.3
1.8.6
ghcr.io/kyverno/reports-controller:v1.12.5c62e3347611c
github.com/sigstore/fulcio@v1.4.3
1.8.6

Open the chart page →

12,562
spirephilips-labsVerified publisher0.12.21 of 6See more

spire philips-labs 0.12.2

1 of the 6 container images this version deploys carry CVE-2026-49478.

Container imageDigestPackageFixed in
ghcr.io/spiffe/spire-agent:1.6.062517726d0c4
github.com/sigstore/fulcio@v0.6.0
1.8.6

Open the chart page →

7,236
cosignedsigstoreVerified publisher0.1.231 of 2See more

cosigned sigstore 0.1.23

1 of the 2 container images this version deploys carry CVE-2026-49478.

Container imageDigestPackageFixed in
gcr.io/projectsigstore/cosigneddigest-pinned784518ff3ee7
github.com/sigstore/fulcio@v0.1.2-0.20220114150912-86a2036f9bc7
1.8.6

Open the chart page →

5,118
scaffoldsigstoreVerified publisher0.6.1141 of 15See more

scaffold sigstore 0.6.114

1 of the 15 container images this version deploys carry CVE-2026-49478.

Container imageDigestPackageFixed in
ghcr.io/sigstore/scaffolding/createctconfig:v0.7.313a061734c5be
github.com/sigstore/fulcio@v1.7.1
1.8.6

Open the chart page →

7,710
ocs-operatorcloud-native-toolkit0.2.41 of 1See more

ocs-operator cloud-native-toolkit 0.2.4

1 of the 1 container images this version deploys carry CVE-2026-49478.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:latest605eaa5d469c
github.com/sigstore/fulcio@v1.8.5
1.8.6

Open the chart page →

369
refarch-infraconfigcloud-native-toolkit0.2.21 of 1See more

refarch-infraconfig cloud-native-toolkit 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-49478.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:latest605eaa5d469c
github.com/sigstore/fulcio@v1.8.5
1.8.6

Open the chart page →

369
pulsarcloudve0.2.01 of 2See more

pulsar cloudve 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-49478.

Container imageDigestPackageFixed in
galaxy/pulsar-kubernetes:0.15.7e50a890e24c9
github.com/sigstore/fulcio@v1.6.4
1.8.6

Open the chart page →

6,162
custom-rhcl-consolecustom-rhcl-consoleVerified publisher0.1.21 of 3See more

custom-rhcl-console custom-rhcl-console 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-49478.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:latest605eaa5d469c
github.com/sigstore/fulcio@v1.8.5
1.8.6

Open the chart page →

1,885
kyvernodevopstalesVerified publisher2.5.12 of 2See more

kyverno devopstales 2.5.1

2 of the 2 container images this version deploys carry CVE-2026-49478.

Container imageDigestPackageFixed in
ghcr.io/kyverno/kyverno:v1.7.19c73f1841ebc
github.com/sigstore/fulcio@v0.1.2-0.20220114150912-86a2036f9bc7
1.8.6
ghcr.io/kyverno/kyvernopre:v1.7.1185d2eebc60c
github.com/sigstore/fulcio@v0.1.2-0.20220114150912-86a2036f9bc7
1.8.6

Open the chart page →

4,722
skopeo-syncfairwinds-incubator0.3.11 of 1See more

skopeo-sync fairwinds-incubator 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-49478.

Container imageDigestPackageFixed in
quay.io/skopeo/stable:v1.134853591bd1d2
github.com/sigstore/fulcio@v1.3.1
1.8.6

Open the chart page →

1,736
fluxcd-helm-upgraderfluxcd-helm-upgraderVerified publisher0.7.71 of 1See more

fluxcd-helm-upgrader fluxcd-helm-upgrader 0.7.7

1 of the 1 container images this version deploys carry CVE-2026-49478.

Container imageDigestPackageFixed in
kenchrcum/fluxcd-helm-upgrader:0.7.7c326e28a8f5f
github.com/sigstore/fulcio@v1.6.6
1.8.6

Open the chart page →

2,420
kcmkcm1.11.01 of 12See more

kcm kcm 1.11.0

1 of the 12 container images this version deploys carry CVE-2026-49478.

Container imageDigestPackageFixed in
ghcr.io/fluxcd/source-controller:v1.9.22b8d06650a1b
github.com/sigstore/fulcio@v1.8.5
1.8.6

Open the chart page →

2,818
agent-control-cdnewrelic1.0.01 of 3See more

agent-control-cd newrelic 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-49478.

Container imageDigestPackageFixed in
ghcr.io/fluxcd/source-controller:v1.5.000cd9316a379
github.com/sigstore/fulcio@v1.6.3
1.8.6

Open the chart page →

5,034
redhat-trusted-application-pipelineopenshift1.0.21 of 2See more

redhat-trusted-application-pipeline openshift 1.0.2

1 of the 2 container images this version deploys carry CVE-2026-49478.

Container imageDigestPackageFixed in
quay.io/redhat-appstudio/appstudio-utils:dbbdd82734232e6289e8fbae5b4c858481a7c0577b4202c25b67
github.com/sigstore/fulcio@v1.4.0
1.8.6

Open the chart page →

8,599
operator-lifecycle-manageroperator-lifecycle-manager1.2.22 of 2See more

operator-lifecycle-manager operator-lifecycle-manager 1.2.2

2 of the 2 container images this version deploys carry CVE-2026-49478.

Container imageDigestPackageFixed in
quay.io/operator-framework/catalogd:v1.8.06ff40fa6257f
github.com/sigstore/fulcio@v1.8.5
1.8.6
quay.io/operator-framework/operator-controller:v1.8.0bca5dfcc67ca
github.com/sigstore/fulcio@v1.8.5
1.8.6

Open the chart page →

1,821
osdfir-infrastructureosdfir-infrastructureVerified publisher2.15.01 of 40See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

1 of the 40 container images this version deploys carry CVE-2026-49478.

Container imageDigestPackageFixed in
ghcr.io/openrelik/openrelik-worker-containers:latesta6d5abe94706
github.com/sigstore/fulcio@v1.8.5
1.8.6

Open the chart page →

71,208
pet-battle-infrapetbattle1.0.321 of 2See more

pet-battle-infra petbattle 1.0.32

1 of the 2 container images this version deploys carry CVE-2026-49478.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:latest605eaa5d469c
github.com/sigstore/fulcio@v1.8.5
1.8.6

Open the chart page →

15,466
pet-battle-tournamentpetbattle1.0.401 of 3See more

pet-battle-tournament petbattle 1.0.40

1 of the 3 container images this version deploys carry CVE-2026-49478.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:latest605eaa5d469c
github.com/sigstore/fulcio@v1.8.5
1.8.6

Open the chart page →

15,466
rancher-auto-registerrancher-auto-registerVerified publisher0.1.01 of 1See more

rancher-auto-register rancher-auto-register 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-49478.

Container imageDigestPackageFixed in
registry.gitlab.com/xrow-public/ci-tools/tools:main9b9d1ed86b6a
github.com/sigstore/fulcio@v1.7.1
1.8.6

Open the chart page →

1,837
gitops-operatorredhat-cop0.10.61 of 1See more

gitops-operator redhat-cop 0.10.6

1 of the 1 container images this version deploys carry CVE-2026-49478.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:latest605eaa5d469c
github.com/sigstore/fulcio@v1.8.5
1.8.6

Open the chart page →

369
ploigosredhat-cop0.0.91 of 2See more

ploigos redhat-cop 0.0.9

1 of the 2 container images this version deploys carry CVE-2026-49478.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:latest605eaa5d469c
github.com/sigstore/fulcio@v1.8.5
1.8.6

Open the chart page →

11,437
sonatype-nexusredhat-cop1.1.131 of 2See more

sonatype-nexus redhat-cop 1.1.13

1 of the 2 container images this version deploys carry CVE-2026-49478.

Container imageDigestPackageFixed in
quay.io/openshift/origin-jenkins-agent-base:latestc241c971aef8
github.com/sigstore/fulcio@v1.4.3
1.8.6

Open the chart page →

16,047
stackrox-chartredhat-cop0.0.101 of 1See more

stackrox-chart redhat-cop 0.0.10

1 of the 1 container images this version deploys carry CVE-2026-49478.

Container imageDigestPackageFixed in
quay.io/rht-labs/stack-do500:3.0.86ba82beff18e
github.com/sigstore/fulcio@v0.1.1
1.8.6

Open the chart page →

29,227
ctlogsigstoreVerified publisher0.2.681 of 4See more

ctlog sigstore 0.2.68

1 of the 4 container images this version deploys carry CVE-2026-49478.

Container imageDigestPackageFixed in
ghcr.io/sigstore/scaffolding/createctconfig:v0.7.313a061734c5be
github.com/sigstore/fulcio@v1.7.1
1.8.6

Open the chart page →

2,728
sigstore-probersigstoreVerified publisher0.3.11 of 1See more

sigstore-prober sigstore 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-49478.

Container imageDigestPackageFixed in
ghcr.io/sigstore/sigstore-probers/prober:v1.0.1d1e914e6d6b9
github.com/sigstore/fulcio@v1.8.5
1.8.6

Open the chart page →

424
devportalveecode-platform-nextVerified publisher0.1.211 of 1See more

devportal veecode-platform-next 0.1.21

1 of the 1 container images this version deploys carry CVE-2026-49478.

Container imageDigestPackageFixed in
veecode/devportaldigest-pinnedc443520aebf7
github.com/sigstore/fulcio@v1.7.1
1.8.6

Open the chart page →

1,787

Container images carrying it

34 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
quay.io/openshift/origin-cli:latest605eaa5d469c
github.com/sigstore/fulcio@v1.8.5
1.8.6
7
ghcr.io/sigstore/scaffolding/createctconfig:v0.7.313a061734c5be
github.com/sigstore/fulcio@v1.7.1
1.8.6
3
ghcr.io/fluxcd/source-controller:v1.9.22b8d06650a1b
github.com/sigstore/fulcio@v1.8.5
1.8.6
2
artifacthub/tracker:v1.23.05368d21a6e5c
github.com/sigstore/fulcio@v1.7.1
1.8.6
1
falcosecurity/falco:0.44.1d0cfe422d6ac
github.com/sigstore/fulcio@v1.8.5
1.8.6
1
falcosecurity/falcoctl:0.13.00eeb79adc580
github.com/sigstore/fulcio@v1.8.5
1.8.6
1
falcosecurity/falco-driver-loader:0.44.17df783d5269a
github.com/sigstore/fulcio@v1.8.5
1.8.6
1
galaxy/pulsar-kubernetes:0.15.7e50a890e24c9
github.com/sigstore/fulcio@v1.6.4
1.8.6
1
kenchrcum/fluxcd-helm-upgrader:0.7.7c326e28a8f5f
github.com/sigstore/fulcio@v1.6.6
1.8.6
1
securesystemsengineering/connaisseur:v3.12.038918befbdad
github.com/sigstore/fulcio@v1.8.5
1.8.6
1
snyk/kubernetes-monitor:2.23.26fb5ad76ce84e
github.com/sigstore/fulcio@v1.8.5
1.8.6
1
veecode/devportalc443520aebf7
github.com/sigstore/fulcio@v1.7.1
1.8.6
1
gcr.io/projectsigstore/cosigned784518ff3ee7
github.com/sigstore/fulcio@v0.1.2-0.20220114150912-86a2036f9bc7
1.8.6
1
ghcr.io/estahn/k8s-image-swapper:1.5.102f5be9cde5f9
github.com/sigstore/fulcio@v1.4.3
1.8.6
1
ghcr.io/fluxcd/source-controller:v1.5.000cd9316a379
github.com/sigstore/fulcio@v1.6.3
1.8.6
1
ghcr.io/kyverno/background-controller:v1.12.506ed5db6cd33
github.com/sigstore/fulcio@v1.4.3
1.8.6
1
ghcr.io/kyverno/cleanup-controller:v1.12.5b914032ef9ad
github.com/sigstore/fulcio@v1.4.3
1.8.6
1
ghcr.io/kyverno/kyverno:v1.7.19c73f1841ebc
github.com/sigstore/fulcio@v0.1.2-0.20220114150912-86a2036f9bc7
1.8.6
1
ghcr.io/kyverno/kyverno:v1.12.5a61c7022abcf
github.com/sigstore/fulcio@v1.4.3
1.8.6
1
ghcr.io/kyverno/kyverno-cli:v1.12.5832a32779e6d
github.com/sigstore/fulcio@v1.4.3
1.8.6
1
ghcr.io/kyverno/kyvernopre:v1.7.1185d2eebc60c
github.com/sigstore/fulcio@v0.1.2-0.20220114150912-86a2036f9bc7
1.8.6
1
ghcr.io/kyverno/kyvernopre:v1.12.563f7eaf5aa8a
github.com/sigstore/fulcio@v1.4.3
1.8.6
1
ghcr.io/kyverno/reports-controller:v1.12.5c62e3347611c
github.com/sigstore/fulcio@v1.4.3
1.8.6
1
ghcr.io/openrelik/openrelik-worker-containers:latesta6d5abe94706
github.com/sigstore/fulcio@v1.8.5
1.8.6
1
ghcr.io/sigstore/sigstore-probers/prober:v1.0.1d1e914e6d6b9
github.com/sigstore/fulcio@v1.8.5
1.8.6
1
ghcr.io/spiffe/spire-agent:1.6.062517726d0c4
github.com/sigstore/fulcio@v0.6.0
1.8.6
1
quay.io/openshift/origin-jenkins-agent-base:latestc241c971aef8
github.com/sigstore/fulcio@v1.4.3
1.8.6
1
quay.io/operator-framework/catalogd:v1.8.06ff40fa6257f
github.com/sigstore/fulcio@v1.8.5
1.8.6
1
quay.io/operator-framework/operator-controller:v1.8.0bca5dfcc67ca
github.com/sigstore/fulcio@v1.8.5
1.8.6
1
quay.io/redhat-appstudio/appstudio-utils:dbbdd82734232e6289e8fbae5b4c858481a7c0577b4202c25b67
github.com/sigstore/fulcio@v1.4.0
1.8.6
1
quay.io/rhdh/rhdh-hub-rhel9:latest0b26358f5793
github.com/sigstore/fulcio@v1.7.1
1.8.6
1
quay.io/rht-labs/stack-do500:3.0.86ba82beff18e
github.com/sigstore/fulcio@v0.1.1
1.8.6
1
quay.io/skopeo/stable:v1.134853591bd1d2
github.com/sigstore/fulcio@v1.3.1
1.8.6
1
registry.gitlab.com/xrow-public/ci-tools/tools:main9b9d1ed86b6a
github.com/sigstore/fulcio@v1.7.1
1.8.6
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.