Server-Side Request Forgery Vulnerability in Gitea by Gitea

CVE-2026-34966

What is CVE-2026-34966?

Gitea versions prior to 1.27.0 are vulnerable to a server-side request forgery (SSRF) flaw that allows authenticated attackers to circumvent built-in SSRF defenses. By taking advantage of HTTP fetch operations during migration and OAuth avatar processes, attackers can exploit the Go default http.Get method, which lacks a custom DialContext. This vulnerability enables attackers to specify arbitrary URLs through various means, such as release asset download URLs, pull-request patch URLs, and OAuth avatar endpoints. This can lead to unauthorized access to internal services, cloud instance metadata, or sensitive local files, which may contain critical application configurations, database credentials, and signing secrets. Exfiltrated data can later be retrieved from migration release assets.

References