CVE-2026-58314
published 2026-07-21CVE-2026-58314: Gitea: Two SSRF findings | --- | --- | | Versions tested | `gitea/gitea:1.26.2` (digest `sha256:7d13848af12645600a5f9d93ee2560daa9c6fa6b5b859b7bff3a5e1c0b661031…
high7.7CVSS 3.1
AVNACLPRLUINSCCHINAN
EPSS
0.29%
21.4th percentile
Gitea: Two SSRF findings
| --- | --- |
| Versions tested | `gitea/gitea:1.26.2` (digest `sha256:7d13848af12645600a5f9d93ee2560daa9c6fa6b5b859b7bff3a5e1c0b661031`); `gitea/gitea:latest` resolves to the same digest at time of writing |
| Source review | `git checkout v1.26.2` (commit `2c749ce`) |
| Reproduction | `bash run_poc.sh` (single shot: brings up containers, runs three PoCs, prints captured evidence, tears down on exit) |
| Files touched by the fixes | `modules/hostmatcher/hostmatcher.go`, `modules/auth/openid/openid.go` |
## Summary
Gitea guards outbound HTTP from webhooks and repo migration with `net.Dialer.Control`, the correct hook point. The IP classifier behind it misses ten address families, of which CGNAT (100.64.0.0/10) is the practically important one because it is plain IPv4 and is used today by Tailscale, AWS VPC secondary CIDRs, and several Kubernetes pod-CIDR conventions. Any logged-in user can create a webhook pointing at an internal CGNAT host. The full HTTP response from that host (status, headers, body up to 1 MB) is stored in the webhook delivery log and rendered to the webhook owner on the hook detail page. The same gap applies to repo migration.
Separately, the OpenID sign-in form at `/user/login/openid` fetches the user-supplied provider URL server-side via `openid-go`, which uses `http.DefaultClient`. No `hostmatcher`, no IP filter, no CSRF, no authentication. When OpenID sign-in is enabled, anyone on the internet can drive Gitea into making arbitrary GET requests against internal IPs.
Both reproduce on `gitea/gitea:1.26.2` (current stable) in default configuration. The bundled `run_poc.sh` reproduces all three primitives end-to-end in about one minute and tears the lab down at exit.
---
## Finding 1: hostmatcher classifier passes CGNAT and IPv6 transition prefixes
### The bug
`modules/hostmatcher/hostmatcher.go:107-119`, the `external` builtin:
```go
case MatchBuiltinExternal:
if ip.IsGlobalUnicast() && !ip.IsPrivate() {
retur
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| code.gitea.io | gitea | >= 0 < 1.27.0 | 1.27.0 |
| openshift-pipelines | pipelines-pipelines-as-code-watcher-rhel9 | — | — |
CVSS provenance
nvdv3.17.7HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
vendor_redhat7.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Gitea: Two SSRF findings
ghsa·2026-07-21
CVE-2026-58314 [HIGH] CWE-918 Gitea: Two SSRF findings
Gitea: Two SSRF findings
| --- | --- |
| Versions tested | `gitea/gitea:1.26.2` (digest `sha256:7d13848af12645600a5f9d93ee2560daa9c6fa6b5b859b7bff3a5e1c0b661031`); `gitea/gitea:latest` resolves to the same digest at time of writing |
| Source review | `git checkout v1.26.2` (commit `2c749ce`) |
| Reproduction | `bash run_poc.sh` (single shot: brings up containers, runs three PoCs, prints captured evidence, tears down on exit) |
| Files touched by the fixes | `modules/hostmatcher/hostmatcher.go`, `modules/auth/openid/openid.go` |
## Summary
Gitea guards outbound HTTP from webhooks and repo migration with `net.Dialer.Control`, the correct hook point. The IP classifier behind it misses ten address families, of which CGNAT (100.64.0.0/10) is the practically important one because it is plain
Red Hat
code.gitea.io/gitea: Gitea: Server-Side Request Forgery via webhooks, repository migration, and OpenID discovery
vendor_redhat·2026-08-13·CVSS 7.7
CVE-2026-58314 [HIGH] CWE-918 code.gitea.io/gitea: Gitea: Server-Side Request Forgery via webhooks, repository migration, and OpenID discovery
code.gitea.io/gitea: Gitea: Server-Side Request Forgery via webhooks, repository migration, and OpenID discovery
Two SSRF findings in Gitea 1.26.2
A flaw was found in Gitea. This vulnerability, known as Server-Side Request Forgery (SSRF), allows an attacker to trick the server into making requests to internal network resources. A logged-in user can exploit this by crafting malicious webhooks or repository migration configurations, leading to the disclosure of sensitive information from internal hosts. Additionally, if OpenID sign-in is enabled, an unauthenticated attacker can trigger blind GET requests to internal IPs through the OpenID discovery process, which can be used for internal network reconnaissance.
Statement: A flaw in Gitea's URL parsing logic allows both authenticated users
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-58314 forgejo: Gitea: Server-Side Request Forgery via webhooks, repository migration, and OpenID discovery [epel-all]
bugzilla·2026-08-24·CVSS 7.7
CVE-2026-58314 [HIGH] CVE-2026-58314 forgejo: Gitea: Server-Side Request Forgery via webhooks, repository migration, and OpenID discovery [epel-all]
CVE-2026-58314 forgejo: Gitea: Server-Side Request Forgery via webhooks, repository migration, and OpenID discovery [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Two SSRF findings in Gitea 1.26.2
Bugzilla
CVE-2026-58314 forgejo: Gitea: Server-Side Request Forgery via webhooks, repository migration, and OpenID discovery [fedora-all]
bugzilla·2026-08-24·CVSS 7.7
CVE-2026-58314 [HIGH] CVE-2026-58314 forgejo: Gitea: Server-Side Request Forgery via webhooks, repository migration, and OpenID discovery [fedora-all]
CVE-2026-58314 forgejo: Gitea: Server-Side Request Forgery via webhooks, repository migration, and OpenID discovery [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Two SSRF findings in Gitea 1.26.2
Bugzilla
CVE-2026-58314 code.gitea.io/gitea: Gitea: Server-Side Request Forgery via webhooks, repository migration, and OpenID discovery
bugzilla·2026-08-13·CVSS 7.7
CVE-2026-58314 [HIGH] CVE-2026-58314 code.gitea.io/gitea: Gitea: Server-Side Request Forgery via webhooks, repository migration, and OpenID discovery
CVE-2026-58314 code.gitea.io/gitea: Gitea: Server-Side Request Forgery via webhooks, repository migration, and OpenID discovery
Two SSRF findings in Gitea 1.26.2
2026-07-21
Published