CVE-2026-22772

CVE-2026-22772 describes a blind Server-Side Request Forgery (SSRF) vulnerability in Fulcio, a certificate authority for OpenID Connect identities, affecting versions prior to 1.8.5. The flaw stems from unanchored regex in the metaRegex() function, allowing attackers to bypass MetaIssuer URL validation. This medium-severity vulnerability (CVSS 5.3) can be exploited remotely without authentication to probe internal networks via GET requests, though it cannot mutate state or exfiltrate data. There is no evidence of active exploitation, public exploit code, or significant community discussion, with only one security update article mentioning it.