Listen to this Post
The vulnerability exists in the Rekor transparency log server, specifically within the `/api/v1/index/retrieve` API endpoint. This endpoint is designed to fetch a public key from a user-supplied URL parameter. When a request is made to this endpoint, the server does not properly validate or restrict the URL input. Consequently, an attacker can craft a request with a URL pointing to an internal, non-public service. The server then initiates a blind HTTP GET request to this specified address. Since the server processes the request, it can interact with systems within the internal network that are normally shielded from external access. The SSRF is classified as “blind” because the HTTP response from the internal service is not returned to the attacker’s client. This prevents direct data exfiltration. However, by analyzing server response times or triggering interactions with known internal endpoints, an attacker can map internal network structures or confirm the existence of services. The attack is limited to GET requests, which typically do not mutate state on the target, reducing the immediate risk of data modification. The primary threat is unauthorized internal network reconnaissance, allowing attackers to probe for other vulnerabilities within the trusted environment.
Platform: Rekor
Version: Before v1.5.0
Vulnerability: Blind SSRF
Severity: Moderate
date: Jan 22 2026
Prediction: Patched v1.5.0
What Undercode Say:
Analytics:
rekor server –enable_retrieve_api=false
curl -X GET
/api/v1/index/retrieve?url=
How Exploit:
Request with internal URL
Probe network services
Blind GET attack
Protection from this CVE:
Upgrade to v1.5.0
Disable retrieve endpoint
Validate input URLs
Impact:
Internal network probing
No data exfiltration
Limited to GET
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
