Authentication Bypass Vulnerability in Soft Serve by Charmbracelet

CVE-2026-24058

What is CVE-2026-24058?

Soft Serve, a self-hostable Git server for command line usage, is affected by a significant authentication bypass issue in versions 0.11.2 and below. This vulnerability allows attackers to impersonate legitimate users, including administrators, by utilizing the victim's public key during the SSH handshake, bypassing authentication with their own valid key. This security flaw exists because the user's identity is maintained in the session context during the 'offer' phase and is not cleared if the authentication attempt fails. The issue has been resolved in version 0.11.3, and users are advised to upgrade to ensure system integrity.

References