SSRF and repository exfiltration via HTTP redirect bypass in Gitea (CVE-2026-57894)

Gitea validates the user-supplied URL before repository migration but passes the original URL to the Git command-line client, which follows HTTP redirects by default. A low-privileged authenticated user can supply a permitted public URL that redirects the Gitea server to an internal or blocked Git HTTP(S) endpoint, causing Gitea to clone and import the internal repository into an attacker-controlled account. Pull mirror configurations extend the exposure by repeating the redirect on each scheduled synchronization, continuously exfiltrating new commits from the internal target. Public POC available. Affected versions: - <= 1.26.4 We recommend updating to: 1.27.0. CVSS 8.5 · our assessment: this_week Reference: https://github.com/go-gitea/gitea/security/advisories/GHSA-82f7-87hm-852x Details: https://vuln.today/cve/CVE-2026-57894