CVE-2026-24117 | sigstore rekor up to 1.4.x Search Endpoint /api/v1/index/retrieve enable_retrieve_api server-side request forgery (GHSA-4c4x-jm2x-pf9j)

A vulnerability, which was classified as critical, has been found in sigstore rekor up to 1.4.x. The impacted element is the function enable_retrieve_api of the file /api/v1/index/retrieve of the component Search Endpoint. Performing a manipulation results in server-side request forgery.

This vulnerability is known as CVE-2026-24117. Remote exploitation of the attack is possible. No exploit is available.

It is advisable to upgrade the affected component.