DEBIAN-CVE-2026-24117

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2026-24117

Import Source

https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-24117.json

JSON Data

https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2026-24117

Upstream

CVE-2026-24117

Published

2026-01-22T22:16:21.577Z

Modified

2026-01-23T10:30:01.763490Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

[none]

Details

Rekor is a software supply chain transparency log. In versions 1.4.3 and below, attackers can trigger SSRF to arbitrary internal services because /api/v1/index/retrieve supports retrieving a public key via user-provided URL. Since the SSRF only can trigger GET requests, the request cannot mutate state. The response from the GET request is not returned to the caller so data exfiltration is not possible. A malicious actor could attempt to probe an internal network through Blind SSRF. The issue has been fixed in version 1.5.0. To workaround this issue, disable the search endpoint with --enableretrieveapi=false.

References

https://security-tracker.debian.org/tracker/CVE-2026-24117

Affected packages

Debian:13 / rekor

Package

Name: rekor
Purl: pkg:deb/debian/rekor?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.3.9-1

1.3.10-1

1.4.0-1

1.4.2-1

1.4.3-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-24117.json"

Debian:14 / rekor