CVE-2026-30832
published 2026-03-07CVE-2026-30832: Soft Serve is a self-hostable Git server for the command line. From version 0.6.0 to before version 0.11.4, an authenticated SSH user can force the server to…
PriorityP260critical9.1CVSS 3.1
AVNACLPRLUINSCCHILAL
EPSS
0.33%
24.6th percentile
Soft Serve is a self-hostable Git server for the command line. From version 0.6.0 to before version 0.11.4, an authenticated SSH user can force the server to make HTTP requests to internal/private IP addresses by running repo import with a crafted --lfs-endpoint URL. The initial batch request is blind (the response from a metadata endpoint won't parse as valid LFS JSON), but an attacker hosting a fake LFS server can chain this into full read access to internal services by returning download URLs that point at internal targets. This issue has been patched in version 0.11.4.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| charm | soft_serve | >= 0.6.0 < 0.11.4 | 0.11.4 |
| charmbracelet | soft-serve | — | — |
| github.com | charmbracelet_soft-serve | >= 0.6.0 < 0.11.4 | 0.11.4 |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for SSH-authenticated `repo import` commands that include a `--lfs-endpoint` flag pointing to internal/private IP address ranges (e.g., RFC1918: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, or loopback 127.0.0.0/8) ↗
- →Detect outbound HTTP requests originating from the Soft Serve process (soft-serve / github.com/charmbracelet/soft-serve) targeting internal/private IP addresses, which would indicate SSRF exploitation via the LFS endpoint chain ↗
- →Alert on Soft Serve versions 0.6.0 through 0.11.3 (inclusive) in your environment; these are the affected range for this SSRF vulnerability ↗
- ·The SSRF is triggered only by authenticated SSH users; unauthenticated access cannot exploit this vector. Ensure SSH authentication is enforced and access is restricted to trusted users. ↗
- ·The initial batch request response is blind (invalid LFS JSON), so the full SSRF read-access impact requires the attacker to also control an external fake LFS server that redirects download URLs to internal targets — a two-stage attack chain. ↗
- ·The vulnerability is fixed in version 0.11.4. Deployments running github.com/charmbracelet/soft-serve should be upgraded to 0.11.4 or later. ↗
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
soft-serve vulnerable to SSRF via unvalidated LFS endpoint in repo import in github.com/charmbracelet/soft-serve
osv·2026-03-10
CVE-2026-30832 soft-serve vulnerable to SSRF via unvalidated LFS endpoint in repo import in github.com/charmbracelet/soft-serve
soft-serve vulnerable to SSRF via unvalidated LFS endpoint in repo import in github.com/charmbracelet/soft-serve
soft-serve vulnerable to SSRF via unvalidated LFS endpoint in repo import in github.com/charmbracelet/soft-serve
GHSA
soft-serve vulnerable to SSRF via unvalidated LFS endpoint in repo import
ghsa·2026-03-06
CVE-2026-30832 [CRITICAL] CWE-918 soft-serve vulnerable to SSRF via unvalidated LFS endpoint in repo import
soft-serve vulnerable to SSRF via unvalidated LFS endpoint in repo import
While auditing the codebase in the wake of the webhook SSRF fix shipped in v0.11.1 (GHSA-vwq2-jx9q-9h9f), it was identified that the LFS import path was never given the same treatment. The webhook fix introduced dual-layer SSRF protection — ValidateWebhookURL() at creation time and secureHTTPClient with IP validation at dial time — but the LFS HTTP client still uses http.DefaultClient with no filtering at all.
### Summary
An authenticated SSH user can force the server to make HTTP requests to internal/private IP addresses by running `repo import` with a crafted `--lfs-endpoint` URL. The initial batch request is blind (the response from a metadata endpoint won't parse as valid LFS JSON), but an attacker hosting a f
OSV
soft-serve vulnerable to SSRF via unvalidated LFS endpoint in repo import
osv·2026-03-06
CVE-2026-30832 [CRITICAL] soft-serve vulnerable to SSRF via unvalidated LFS endpoint in repo import
soft-serve vulnerable to SSRF via unvalidated LFS endpoint in repo import
While auditing the codebase in the wake of the webhook SSRF fix shipped in v0.11.1 (GHSA-vwq2-jx9q-9h9f), it was identified that the LFS import path was never given the same treatment. The webhook fix introduced dual-layer SSRF protection — ValidateWebhookURL() at creation time and secureHTTPClient with IP validation at dial time — but the LFS HTTP client still uses http.DefaultClient with no filtering at all.
### Summary
An authenticated SSH user can force the server to make HTTP requests to internal/private IP addresses by running `repo import` with a crafted `--lfs-endpoint` URL. The initial batch request is blind (the response from a metadata endpoint won't parse as valid LFS JSON), but an attacker hosting a f
No detection rules found.
No public exploits indexed.
2026-03-07
Published