Improper certificate validation in Gitea internal API HTTP client (CVE-2026-54481)

Gitea's internal API HTTP client hardcodes `InsecureSkipVerify = true` in its TLS configuration with no operator override, making it the only outbound TLS client in the codebase that cannot be configured to verify peer certificates. In split-host or multi-pod deployments where `LOCAL_ROOT_URL` uses HTTPS to a non-loopback target, an on-path attacker can intercept the connection, accept any certificate, and capture the static `INTERNAL_TOKEN` bearer credential. A stolen token grants unauthenticated access to all `/api/internal/*` endpoints, enabling server shutdown, SSH key authorization, git command execution, hook manipulation, mail delivery, and runner-token generation. Affected versions: - <= 1.26.4 We recommend updating to: 1.27.0. CVSS 7.5 · our assessment: this_week Reference: https://github.com/go-gitea/gitea/security/advisories/GHSA-94v3-77j7-vm48 Details: https://vuln.today/cve/CVE-2026-54481