SSH Authentication Vulnerability in Gitea by Gitea
CVE-2026-103059

9.1CRITICAL

Key Information:

Vendor

Gitea

Status
Gitea
Vendor
CVE Published:
6 October 2026

What is CVE-2026-103059?

Gitea's built-in SSH server, when enabled, allows for a public key lookup using an SQL 'LIKE' comparison, which may be case-insensitive in certain database systems like SQLite. This flaw could enable an attacker to create a case variant of another user's RSA public key, facilitating unauthorized SSH authentication as that user. Recent updates have switched the public key lookup methodology to one based on strict fingerprint matching to mitigate this risk.

Affected Version(s)

Gitea 0 <= 1.27.3

References

https://github.com/go-gitea/gitea/security/advisories/GHS...
vendor-advisory
https://github.com/go-gitea/gitea/pull/39423
patch
https://blog.gitea.com/release-of-28.0.0/
release-notes

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

https://github.com/carlini
https://github.com/TheFox0x7
https://github.com/wxiaoguang
.