Gitea CVE-2026-70357

Requires (1) the ability to initiate a repository migration/mirror in Gitea - on a default install this needs a logged-in user account, though instances with open registration make this effectively unauthenticated; and (2) attacker control over the authoritative DNS for the destination hostname so it resolves to an allowed address during the migration HTTP client's validation and to a blocked internal address when the independent Git clone subprocess later resolves it (classic DNS-rebinding TOCTOU). Exploitation is LIMITED by: the need to control destination DNS with short TTLs, the requirement that migration functionality be reachable, and the version ceiling (Gitea ≤1.27.3; fixed in 28.0.0). The flaw only affects direct connections - when a proxy is configured for Git/migrations, egress restriction becomes the proxy's responsibility and this validation gap does not apply the same way. The bypass defeats the ALLOWED_HOST_LIST/blocked-host egress controls specifically on the Git subprocess path.

Signals conflict in a way that pulls real-world priority below the 7.5 CVSS 'High' rating. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes an easy remote attack, but EPSS is only 0.15% (3rd percentile) and CISA SSVC lists Exploitation: none, so there is no evidence of real-world activity - it is not in KEV and no public exploit is identified at time of analysis. SSVC's Automatable: yes is credible because DNS rebinding can be scripted with low-TTL records, yet Technical Impact: partial matches the limited nature of a git-clone SSRF. Two discrepancies should be verified: (1) the CVSS vector sets PR:N, but the description's prerequisite 'an attacker who can start a migration' realistically implies an authenticated account on default Gitea (open registration would restore effective PR:N) - verify against instance configuration; (2) NVD scores impact as C:N/I:H/A:N, which is atypical for an SSRF that normally yields confidentiality impact (reading internal services) rather than integrity - treat the impact type as uncertain. Net: a genuine, well-understood TOCTOU/SSRF bug worth patching on internet-reachable Gitea instances (especially with open registration), but currently a moderate rather than urgent priority given no exploitation, very low EPSS, and the DNS-control precondition.

An attacker with access to the migration feature points a repository migration at a hostname under their control. Their authoritative DNS returns an allowed public IP while Gitea validates the host against its allow/block lists, then rebinds the name to a blocked internal address (e.g., cloud metadata or an intranet Git/HTTP service) by the time the Git subprocess independently resolves and connects, bypassing the egress controls. No public proof-of-concept is identified at time of analysis, but the DNS-rebinding technique is well understood and scriptable.