What is the CVSS score of CVE-2026-24058?

CVE-2026-24058 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-24058?

Within 24 hours: Identify all Soft Serve instances in use and assess exposure scope; notify relevant business and technical stakeholders. Within 7 days: Apply the available vendor patch to all affected systems; conduct verification testing in non-production environments first. Within 30 days: Validate patch deployment across all systems; conduct access log review for indicators of exploitation; implement enhanced monitoring for suspicious authentication patterns.

Soft Serve CVE-2026-24058

Q: Which versions of Soft Serve are affected by CVE-2026-24058?

CVE-2026-24058 is a critical authentication bypass vulnerability in Soft Serve that enables attackers to impersonate any user, including administrators, by exploiting public key handling.. A patch is available.

CRITICAL

Authentication Bypass by Alternate Name (CWE-289)

2026-01-22 security-advisories@github.com

GHSA-pchf-49fh-w34r

Authentication Bypass SSH Soft Serve Suse Charm

9.8

CVSS 3.1 · GitHub Advisory

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Initiate SSH connection to Soft Serve
Delivery

Offer victim's public key during handshake
Exploit

Session retains victim identity after offer fails
Execution

Authenticate with attacker's own key
Impact

Access granted as impersonated user

Vulnerability Assessment

Weakness	CWE CWE-289 OWASP Top 10:2025 A07:2025 - Authentication Failures ASVS 5.0 V6 - Authentication Alternate name authentication
Exploitation Conditions	Soft Serve versions 0.11.2 and below with SSH enabled. Attacker requires knowledge of victim's public key (publicly available in Git repositories). No authentication credentials needed; remote, unauthenticated exploitation possible against default SSH configurations.
Impact	CVSS 9.8 with patch available. Soft Serve is a minimalist Git server — authentication bypass exposes all hosted private repositories.
Exploit ScenarioDerived	An attacker discovers a Soft Serve instance and exploits the authentication bypass to clone all private repositories, accessing proprietary source code, configuration files, and secrets stored in Git.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Soft Serve self-hosted Git server versions 0.11.2 and below have a critical authentication bypass that allows unauthenticated access to private repositories.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 21:54 CVSS 9.8

Authentication bypass in Soft Serve Git server exposes private repositories.

RemediationAI

Update to a patched version immediately. Audit Git access logs for unauthorized repository access.

Affected Packages

go github.com/charmbracelet/soft-serve fix: 0.11.3

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in go

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Soft Serve <= 0.11.2 has a CWE-289 authentication bypass using an alternate path that allows unauthenticated users to access private Git repositories, including cloning, reading code, and potentially pushing changes.

Know when Soft Serve gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SUSE 8.1 HIGH

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Feb 18, 2026 - 14:49 nvd

Patch available

CVE Published

Jan 22, 2026 - 22:16 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

Soft Serve is a self-hostable Git server for the command line. Versions 0.11.2 and below have a critical authentication bypass vulnerability that allows an attacker to impersonate any user (including admin) by "offering" the victim's public key during the SSH handshake before authenticating with their own valid key. This occurs because the user identity is stored in the session context during the "offer" phase and is not cleared if that specific authentication attempt fails. This issue has been fixed in version 0.11.3.

Executive ViewAI

Why It Matters

CVE-2026-24058 is a critical authentication bypass vulnerability in Soft Serve that enables attackers to impersonate any user, including administrators, by exploiting public key handling. This poses an immediate risk to organizational data confidentiality, integrity, and availability, as well as regulatory compliance.

Business Impact: Severe

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.0%

Top 86% exploitable

Data Quality

4 sources

Confidence: Medium

NVD

CVE.org

EPSS Vendor

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.