SSRF Vulnerabilities in Gitea from Gitea
CVE-2026-58508

Currently unrated

Key Information:

Vendor

Gitea

Status
Gitea Open Source Git Server
Vendor
CVE Published:
13 August 2026

What is CVE-2026-58508?

Gitea is impacted by two server-side request forgery (SSRF) vulnerabilities arising from improper handling of DNS requests during migration and mirroring processes. These vulnerabilities involve a lack of re-validation and are exploitable through DNS rebinding techniques, potentially allowing malicious actors to make unauthorized requests to internal services. Users are encouraged to upgrade to Gitea version 1.27.0 or later to mitigate risks associated with this security flaw.

Affected Version(s)

Gitea Open Source Git Server 0 <= 1.26.4

References

https://github.com/go-gitea/gitea/security/advisories/GHS...
vendor-advisory
https://github.com/go-gitea/gitea/releases/tag/v1.27.0
release-notes
https://blog.gitea.com/gitea-1.27.0-is-released/
release-notes

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

AmerMrkaljevic
.