CVE-2026-24117

Name of the Vulnerable Software and Affected Versions Rekor versions 1.4.3 and below

Description Rekor is a software supply chain transparency log. A Server-Side Request Forgery (SSRF) exists in versions 1.4.3 and below due to the /api/v1/index/retrieve endpoint supporting retrieval of a public key via a user-provided URL. The SSRF is limited to GET requests and does not allow for state modification or data exfiltration. An attacker could potentially probe an internal network through Blind SSRF.

Recommendations Disable the search endpoint with --enable retrieve api=false.