CyberRota Analysis
AI-GeneratedKubernetes versions up to 1.8.5 are vulnerable due to improper handling of cross-host redirects in Fulcio, which can lead to blind SSRF attacks and unauthorized disclosure of ServiceAccount tokens. This vulnerability allows malicious actors to substitute and cache malicious JWKS keys, potentially compromising the security of Kubernetes deployments. Organizations using affected versions should prioritize upgrading to version 1.8.6 or later to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a malicious or compromised issuer to perform blind SSRF, substitute and cache malicious JWKS keys, or disclose ServiceAccount tokens to external hosts. Version 1.8.6 blocks cross-host redirects, restricts token injection, and restricts local token loading. No known workarounds are available.