Remote Code Execution Vulnerability in Soft Serve Git Server

CVE-2026-30832

What is CVE-2026-30832?

Soft Serve, a self-hostable Git server, has a vulnerability that allows authenticated SSH users to manipulate the server into making unauthorized HTTP requests to internal IP addresses. By using a crafted --lfs-endpoint URL during the repository import process, an attacker can exploit this weakness. Although the initial request does not yield a valid response, an attacker who controls a malicious LFS server can leverage this flaw to gain full read access to internal services by providing download URLs targeting sensitive internal resources. This vulnerability has been addressed in Soft Serve version 0.11.4.

References