Sigstore Timestamp Authority: unauthenticated requests mint unbounded Prometheus series until memory is exhausted

Impact

The global wrapMetrics middleware records the raw request path (r.URL.Path) and raw method (r.Method) as Prometheus labels on the latency and request-count vectors, and does so before routing - so values that match no route are still turned into labels. An unauthenticated client sending requests to /api/v1/timestamp/<random-uuid>, or with random HTTP methods, creates permanent time-series entries that are never reclaimed, until the TSA process exhausts memory and dies. Two things break for an operator: the timestamp authority itself, which stalls the signing and attestation steps of image and model-artifact pipelines that depend on RFC 3161 timestamps, and the Prometheus server scraping it, which ingests the cardinality bomb and can be pushed over its own memory limits - taking fleet monitoring down with the service that was attacked. Fixed in 2.1.0.

Who can reach it

Any unauthenticated client that can reach the TSA's HTTP listener. No credentials, no valid timestamp request, no specific path required - arbitrary paths are the attack. Exposure is whatever the listener is bound to; an internet-exposed or tenant-reachable TSA is directly at risk, one behind mTLS or an internal-only ingress much less so.

What to do

Upgrade to timestamp-authority 2.1.0 and restart the service - a daemon restart of a control-plane component, no node drain. Until you can, put the listener behind authentication or an ingress that rejects unrouted paths and non-standard methods, cap the TSA's memory so it restarts instead of taking the node, and apply a metric_relabel_config on the Prometheus side to drop the path/method labels so an attempt cannot also damage your monitoring.

References

Related entries

• rclone (local backend, --links): When rclone copies from an untrusted remote with --links, it recreates symlinksCVE-2026-54572 · rclone (local backend, --links)High
• Jenkins Script Security Plugin: Groovy sandbox escape via AST annotation extensions memberCVE-2026-57281 · Jenkins Script Security Plugin (Groovy sandbox, AST transformation annotations)High
• NVIDIA AIStore: Promote API reads any file reachable by the target processCVE-2026-65161 · NVIDIA AIStore (Promote API, absolute source path)High
• Airflow Backfill API: any Dag editor can read and cancel backfills belonging to other DagsCVE-2026-68968 · Apache Airflow Backfill API (authorization dependency id parsing)High
• GitLab CE/EE: improper input validation lets an unauthenticated user cause a denial of serviceCVE-2026-7427 · GitLab CE/EE (unauthenticated request path, improper input validation)High
• Apache Airflow: asset queued-event deletion gated on READ instead of EDIT permissionCVE-2026-75157 · Apache Airflow (asset queued-events DELETE endpoints)High