SSRF in Linuxfoundation Rekor
CVE-2026-24117
Rekor is a software supply chain transparency log. In versions 1.4.3 and below, attackers can trigger SSRF to arbitrary internal services because /api/v1/index/retrieve supports retrieving a public key via user-provided URL. Since the SSRF only can trigger GET requests, the request cannot mutate state. The response from the GET request is not returned to the caller so data exfiltration is not possible. A malicious actor could attempt to probe an internal network through Blind SSRF. The issue has been fixed in version 1.5.0. To workaround this issue, disable the search endpoint with --enable_retrieve_api=false.
Vulnerability class: SSRF (Server-Side Request Forgery)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
EPSS exploit prediction
EPSS: 0.004 (28.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 28th percentile — 28.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.004 · change: +0.000
Affected products
- Linuxfoundation Rekor
- Sigstore Rekor — versions < 1.5.0
Weakness classification (CWE)
References
- github.com/sigstore/rekor/security/advisories/GHSA-4c4x-jm2x-pf9j (Vendor Advisory)
- github.com/sigstore/rekor/commit/60ef2bceba192c5bf9327d003bceea8bf1f8275f (Patch)
- github.com/sigstore/rekor/releases/tag/v1.5.0 (Product, Release Notes)
Frequently asked questions
- What is CVE-2026-24117?
- CVE-2026-24117 is a medium-severity vulnerability in Linuxfoundation Rekor, classified under Server-Side Request Forgery (SSRF). CVSS score: 5.3/10. Published 2026-01-22.
- How severe is CVE-2026-24117?
- Medium severity. CVSS v3 base score is 5.3 out of 10.