EUVD-2026-58174Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Migration/mirror needs an account (PR:L) and DNS-rebinding is a race (AC:H); high confidentiality from reading internal responses, limited integrity, no availability impact.
Primary rating from Vendor (Gitea).
CVSS VectorVendor: Gitea
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)
AnalysisAI
Server-side request forgery in Gitea Open Source Git Server (all versions through 1.26.4) lets attackers abuse the repository migration and mirror features to reach internal network resources. Two distinct weaknesses are involved: a DNS-rebinding bypass where a hostname resolves to a permitted address during validation and to an internal address when the actual request is made, and a missing re-validation flaw where redirect or subsequent fetch targets are not re-checked against the allow/deny policy. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the ability to initiate a repository migration or configure a pull mirror - i.e., access to Gitea's migration/mirror feature, which in most deployments means a registered user account (the published CVSS marks PR:N, appropriate for instances with open registration; on restricted instances an account is a real prerequisite - authentication requirements should be confirmed against your instance config). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals here are mixed and should be read carefully. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with (or able to self-register) a Gitea account creates a repository migration or mirror pointing at a hostname they control. The hostname passes Gitea's allow-list check when first resolved, then rebinds to an internal address (or 302-redirects to one) so the server fetches from cloud metadata or an internal admin service and the attacker reads the returned content. … |
| Remediation | Vendor-released patch: upgrade to Gitea 1.27.0 (https://github.com/go-gitea/gitea/releases/tag/v1.27.0), which addresses both the DNS-rebinding bypass and the missing redirect/re-validation checks per advisory GHSA-j72v-mjr6-3424. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all Gitea deployments to identify instances running version 1.26.4 or earlier, prioritize those accessible over the internet, and review which teams actively use repository migration and mirror functions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Broken access control in Gitea's Composer package registry (versions up to and including 1.26.1) lets remote attackers r
Gitea before 1.16.7 does not escape git fetch remote. Rated high severity (CVSS 7.5), this vulnerability is remotely exp
The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer envir
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea
Reverse-proxy authentication bypass in the official Gitea Docker image (versions up to and including 1.26.2) allows any
Container escape in Gitea act_runner (Docker backend, through act 0.262.0) lets an authenticated user with workflow-exec
models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to rem
Server-side request forgery and internal repository exfiltration in Gitea before 1.27.0 lets a low-privileged authentica
An issue was discovered in Gitea through 1.11.5. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
Missing Authorization in GitHub repository go-gitea/gitea prior to 1.16.4. Rated high severity (CVSS 7.1), this vulnerab
Open Redirect on login in GitHub repository go-gitea/gitea prior to 1.16.5. Rated medium severity (CVSS 6.1), this vulne
Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged us
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today