What is the CVSS score of CVE-2026-24117?

CVE-2026-24117 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Rekor are affected by CVE-2026-24117?

Organizations using transparency log. In should be aware of moderate risk from CVE-2026-24117, a server-side request forgery vulnerability rated CVSS 5.3.. A patch is available.

How to fix or mitigate CVE-2026-24117?

Within 30 days: Identify affected systems running transparency log. In and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Rekor CVE-2026-24117

MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-01-22 security-advisories@github.com

GHSA-4c4x-jm2x-pf9j

SSRF Rekor Red Hat Suse

5.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SUSE

MEDIUM

qualitative

Red Hat

5.3 MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

Patch released

Feb 02, 2026 - 15:07 nvd

Patch available

CVE Published

Jan 22, 2026 - 22:16 nvd

MEDIUM 5.3

DescriptionGitHub Advisory

Rekor is a software supply chain transparency log. In versions 1.4.3 and below, attackers can trigger SSRF to arbitrary internal services because /api/v1/index/retrieve supports retrieving a public key via user-provided URL. Since the SSRF only can trigger GET requests, the request cannot mutate state. The response from the GET request is not returned to the caller so data exfiltration is not possible. A malicious actor could attempt to probe an internal network through Blind SSRF. The issue has been fixed in version 1.5.0. To workaround this issue, disable the search endpoint with --enable_retrieve_api=false.

AnalysisAI

Rekor versions 1.4.3 and earlier contain a server-side request forgery (SSRF) vulnerability in the /api/v1/index/retrieve endpoint that allows unauthenticated remote attackers to probe internal networks through blind SSRF attacks by supplying arbitrary URLs for public key retrieval. While the vulnerability cannot directly exfiltrate data or modify state since responses are not returned and only GET requests are supported, it enables reconnaissance of internal infrastructure. The issue is patched in version 1.5.0, or can be mitigated by disabling the retrieve API with --enable_retrieve_api=false.

Technical ContextAI

Classified as CWE-918 (Server-Side Request Forgery (SSRF)). Affects Rekor. Rekor is a software supply chain transparency log. In versions 1.4.3 and below, attackers can trigger SSRF to arbitrary internal services because /api/v1/index/retrieve supports retrieving a public key via user-provided URL. Since the SSRF only can trigger GET requests, the request cannot mutate state. The response from the GET request is not returned to the caller so data exfiltration is not possible. A malicious actor could attempt to probe an internal network through Blind SSRF. The issue has

RemediationAI

A vendor patch is available — apply it immediately. Fixed in version 1.5.0.. Restrict network access to the affected service where possible.

More in Rekor

View all

CVE-2023-30551 HIGH This Week

7.5 May 08

Rekor is an open source software supply chain transparency log. Rated high severity (CVSS 7.5), this vulnerability is re

CVE-2026-23831 MEDIUM This Month

5.3 Jan 22

Rekor versions 1.4.3 and below are vulnerable to denial of service through a null pointer dereference when processing ma

CVE-2023-33199 MEDIUM This Month

5.3 May 26

Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects suppl

Same weakness CWE-918 – Server-Side Request Forgery (SSRF)

View all

CVE-2021-34473 CRITICAL POC

9.1

CVE-2021-26855 CRITICAL POC

9.1

CVE-2022-41040 HIGH POC

8.8

CVE-2024-21893 HIGH POC

8.2

CVE-2023-48022 CRITICAL POC

9.8

CVE-2016-3718 MEDIUM POC

5.5

CVE-2015-8813 HIGH POC

8.2

CVE-2020-24881 CRITICAL POC

9.8

Same technique SSRF

View all

CVE-2016-3718 MEDIUM POC

5.5

CVE-2015-8813 HIGH POC

8.2

CVE-2020-24881 CRITICAL POC

9.8

CVE-2026-15409 CRITICAL POC

10.0

CVE-2024-54385 HIGH POC

7.2

CVE-2022-45835 MEDIUM POC

5.8

CVE-2024-54330 HIGH POC

7.2

CVE-2026-20230 HIGH POC

8.6

Vendor StatusVendor

SUSE

Severity: Medium

Product	Status
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Fixed

CVE-2026-24117 vulnerability details – vuln.today

Back

Rekor CVE-2026-24117

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

DescriptionGitHub Advisory

AnalysisAI

Technical ContextAI

RemediationAI

More in Rekor

Same weakness CWE-918 – Server-Side Request Forgery (SSRF)

Same technique SSRF

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code