CVE-2026-24117

CVE-2026-24117 is a Blind Server-Side Request Forgery (SSRF) vulnerability affecting Rekor versions 1.4.3 and below, a software supply chain transparency log. Attackers can exploit a user-provided URL in the /api/v1/index/retrieve endpoint to trigger GET requests to arbitrary internal services. Rated as Medium severity (CVSS 5.3), this vulnerability has a network attack vector and low attack complexity, requiring no user interaction or privileges. While it cannot mutate state or exfiltrate data, it allows for internal network probing. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage. A fix is available in Rekor version 1.5.0, and a workaround involves disabling the search endpoint.