Server-side request forgery in Gitea hostmatcher and OpenID sign-in (CVE-2026-58314)

Gitea's IP classifier in the `hostmatcher` module fails to block ten address families including CGNAT (100.64.0.0/10), allowing any authenticated user to direct webhook deliveries or repository migrations to internal hosts and read up to 1 MB of the response. Additionally, the OpenID sign-in endpoint fetches user-supplied provider URLs server-side with no IP filtering and no authentication requirement, enabling unauthenticated arbitrary GET requests to internal addresses when OpenID sign-in is enabled. Affected versions: - <= 1.26.4 We recommend updating to: 1.27.0. CVSS 7.7 · our assessment: this_week Reference: https://github.com/go-gitea/gitea/security/advisories/GHSA-2fcr-jfvc-vgg2 Details: https://vuln.today/cve/CVE-2026-58314