Which versions of Gitea are affected by CVE-2026-34966?

Gitea versions prior to 1.27.0 contain an SSRF bypass that allows authenticated users to extract database credentials and signing secrets from affected servers.. A patch is available.

How to fix or mitigate CVE-2026-34966?

Within 24 hours, audit all Gitea instances using 'gitea --version' to identify those running versions prior to 1.27.0 and alert your infrastructure and security teams immediately. Within 7 days, apply Gitea 1.27.0 patch or later following vendor upgrade procedures, validate configuration files post-deployment, and confirm service connectivity. Within 30 days, review authentication logs for suspicious internal service or metadata endpoint access (particularly 169.254.169.254), and proactively rotate all database credentials and signing secrets currently stored in Gitea configuration files.

Gitea CVE-2026-34966

Q: What is the CVSS score of CVE-2026-34966?

CVE-2026-34966 has a CVSS 4.0 base score of 8.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-53617 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-08-05 VulnCheck

GHSA-685p-fm6j-c445

SSRF Red Hat Gitea Suse

8.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.5 HIGH

Any authenticated user can trigger migration in default configs; file:// read and internal HTTP access constitute scope change with high confidentiality impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

SUSE

HIGH

qualitative

Red Hat

7.6 HIGH

qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 05, 2026 - 21:23 vuln.today

Analysis Generated

Aug 05, 2026 - 21:23 vuln.today

CVE Published

Aug 05, 2026 - 20:28 cve.org

HIGH 8.3

DescriptionCVE.org

Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply arbitrary URLs through release asset download URLs, pull-request patch URLs, or OAuth avatar endpoints to reach internal services, cloud instance-metadata endpoints, or read local files such as the application configuration containing database credentials and signing secrets, with exfiltrated content persisted as migration release assets for later retrieval.

AnalysisAI

SSRF protection bypass in Gitea prior to 1.27.0 exposes internal services, cloud instance-metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254), and local files - including the application configuration containing database credentials and signing secrets - to authenticated attackers. Three HTTP fetch code paths in the migration and OAuth avatar subsystems use Go's raw http.Get() rather than the hardened hostmatcher.NewDialContext() transport used elsewhere, completely circumventing Gitea's built-in SSRF defenses. A publicly available proof-of-concept is included in the GHSA advisory; no confirmed active exploitation (CISA KEV) has been identified at time of analysis.

Technical ContextAI

The vulnerability (CWE-918, Server-Side Request Forgery) stems from an inconsistency in Gitea's Go codebase: while migration clone and webhook operations correctly use a custom DialContext via hostmatcher.NewDialContext() that validates resolved IPs against an allow/block list, three separate code paths fall back to Go's net/http.DefaultClient, which performs no such validation. Specifically, modules/uri/uri.go (line 32) uses http.Get() for HTTP/HTTPS URIs and os.Open() for file:// URIs; this function is called from services/migrations/gitea_uploader.go at line 340 (release asset download) and line 586 (PR patch fetch), and from services/migrations/dump.go at lines 312 and 453. Additionally, routers/web/auth/oauth.go (line 306) uses http.Get() to fetch OAuth avatar URLs without any hostmatcher filtering. The explicit file:// scheme handler in uri.Open() further enables arbitrary local file reads beyond network-based SSRF. Affected products are all Gitea releases from 0 through 1.26.4 (CPE: cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*).

RemediationAI

Upgrade Gitea to version 1.27.0 or later, which replaces the unprotected http.Get() calls with the hostmatcher-backed transport already used for migration clones and webhooks; the patch commit is b969123b7fac51c88daab5cb64e5b2f4abd53288 (https://github.com/go-gitea/gitea/commit/b969123b7fac51c88daab5cb64e5b2f4abd53288). If immediate upgrade is not feasible, set DISABLE_MIGRATIONS = true in the [repository] section of app.ini to remove the migration code paths entirely, at the cost of disabling all repository migration functionality. Disabling OAuth login (if not operationally required) eliminates the avatar fetch vector. Deploy host-level egress filtering on the Gitea server to block RFC 1918 ranges and the link-local range 169.254.0.0/16; note this does not address the file:// local file read path and is not a substitute for patching. Advisory reference: https://github.com/go-gitea/gitea/security/advisories/GHSA-2wm4-vwp6-v7xc.