Soft Serve

CVE-2026-30832 Mar 07, 16:15 Go CRITICAL POC PATCH Act Now

SSRF in Soft Serve Git server versions 0.6.0 to 0.11.3 allows authenticated attackers to make requests to internal services. PoC and patch available.

CVE-2026-24058 Jan 22, 22:16 Go CRITICAL PATCH Act Now

Soft Serve self-hosted Git server versions 0.11.2 and below have a critical authentication bypass that allows unauthenticated access to private repositories.

CVE-2026-91773 Sep 15, 01:20 MEDIUM PATCH This Month

Let me synthesize this into the required JSON. Key facts: - CVE-2026-91773, Soft Serve (charmbracelet/soft-serve), Git LFS lock metadata disclosure. - CWE-639 Authorization Bypass Through User-Controlled Key (IDOR) - CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N → 5.3 - Affected: 0.7.1 through 0.11.6 (fixed in 0.12.0) - Patch: vendor available; commit e34914699128c937afad167d43ccb5310e48b319 adds repo_id scoping. - No KEV, no POC noted explicitly. But commit includes tests. No EPSS given. - Tags: Authentication Bypass, Soft Serve. Product name: "Soft Serve" (charmbracelet soft-serve) — 2 words. Good. Prevalence: Soft Serve is a self-hosted Git server — niche. "low" or "rare". It's a fairly well-known project in the Charm ecosystem but not widely deployed enterprise. I'll say "low" with basis "self-hosted Git server, niche deployment footprint". Assessed CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N = 4.3. Wait: CVSS 3.1 with PR:L, C:L → base score. Let me compute: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. Exploitability = 8.22 * AV(0.85) * AC(0.77) * PR(0.62) * UI(0.85) = 8.22*0.85=6.987; *0.77=5.38; *0.62=3.335; *0.85=2.835. Impact sub-score for C:L only: ISS = 1 - [(1-0.22)*(1-0)*(1-0)] = 0.22. Impact = 6.42*0.22 = 1.412. Base = roundup(min(1.412+2.835, 10)) = roundup(4.247) = 4.3. Fine. CVSS 4.0: matches provided: AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Attack chain: Authenticate to Soft Serve → Access any repo with write permission (own repo) → Enumerate LFS lock IDs via lock list endpoint → Retrieve lock metadata from private repos → Recover file paths, usernames, timestamps. 5 steps. Exploitation conditions: requires authenticated account with write access to at least one repository; the LFS lock list endpoint accepts `id` query param; target must be using Soft Serve Git LFS locks feature with locks present in private repos. Limits: read-only (confidentiality only), no ability to modify/delete others' locks? Actually

CVE-2026-22253 Jan 08, 19:15 Go MEDIUM POC PATCH This Month

Soft Serve versions prior to 0.11.2 contain an authorization bypass in the LFS lock deletion endpoint that allows authenticated users to forcibly delete locks owned by other users by exploiting improper validation order. Any user with repository write access can leverage this vulnerability to disrupt collaborative workflows by removing locks created by teammates. A public exploit exists and patches are available.

CVE-2025-64522 Nov 10, 23:15 Go CRITICAL POC PATCH Act Now

Soft Serve is a self-hostable Git server for the command line. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

CVE-2025-22130 Jan 08, 16:15 Go MEDIUM PATCH This Month

Soft Serve is a self-hostable Git server for the command line. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.

CVE-2023-43809 Oct 04, 21:15 Go HIGH POC PATCH This Week

Soft Serve is a self-hostable Git server for the command line. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.