# Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage

Fulcio's OIDC discovery client followed cross-host redirects, enabling blind SSRF, JWKS cache poisoning, and leakage of the in-cluster Kubernetes ServiceAccount token to external hosts.

- Payout: Research
- Severity: high
- Program: Fulcio
- Found by: bugbunny-research
- Disclosed: 2026-06-30
- CVE: CVE-2026-49478
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-f5mr-q85p-6hh6
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-f5mr-q85p-6hh6
- Tags: area:cloud domain:cloud impact:integrity impact:internal-access kind:research platform:ghsa sev:high tech:kubernetes tech:oidc technique:source-review vuln:cache-poisoning vuln:secrets-leak vuln:ssrf

**Target:** OIDC discovery client / Kubernetes ServiceAccount token transport
**Root cause:** The OIDC discovery HTTP client followed cross-host redirects by default, and the transport attached the in-cluster Kubernetes ServiceAccount token globally rather than only to the exact issuer host, so redirects and wildcard MetaIssuers leaked the token and allowed attacker-controlled jwks_uri.
**Steps:**
1. Configure or compromise an issuer so its `/.well-known/openid-configuration` returns an HTTP redirect to a different host.
2. Fulcio's discovery client follows the cross-host redirect, issuing requests to internal-only systems (blind SSRF).
3. Return a malicious `jwks_uri` pointing to an attacker-controlled host; Fulcio initializes the provider and caches the verifier, poisoning the verifier cache with attacker keys.
4. Present signatures validated against the poisoned keys.
5. Alternatively, trigger a redirect or wildcard `kubernetes` MetaIssuer match so the transport attaches the local in-cluster ServiceAccount token to the external host.
**How found:** Code review of the OIDC discovery HTTP client and transport: noticing default redirect-following behavior and that the ServiceAccount token was attached globally by the transport rather than scoped to the issuer host.
**Exploitation:** A malicious or compromised issuer redirects Fulcio's discovery fetch to internal systems and/or supplies an attacker-controlled jwks_uri; Fulcio caches the attacker verifier, letting the attacker's signatures validate. Redirects and wildcard MetaIssuer matches also cause the mounted Kubernetes ServiceAccount token to be sent to third-party hosts.
**Escalation:** JWKS cache poisoning converts blind SSRF into signature forgery; token leakage exposes cluster credentials to external hosts.
**Insight:** When auditing OIDC/OAuth discovery clients, check whether redirects are followed across hosts and whether credentials (e.g. mounted SA tokens) are attached by transport globally instead of scoped to the exact issuer host — wildcard metaissuers widen that blast radius.