CVE-2026-31959

CVE-2026-31959 is a Server-Side Request Forgery (SSRF) vulnerability affecting Anchore Quill versions prior to 0.7.1, occurring when the software attempts to fetch Apple notarization submission logs. This medium-severity vulnerability (CVSS 5.3) has a high attack complexity, as exploitation requires an attacker on an adjacent network to tamper with Apple API responses, typically through TLS-intercepting proxies or compromised certificate authorities. Successful exploitation could lead to high confidentiality impact, allowing the exfiltration of sensitive data like cloud provider credentials or internal service responses. There is currently no evidence of active exploitation, public exploit code, or significant community discussion, and it is not listed in CISA's Known Exploited Vulnerabilities catalog.