Server-Side Request Forgery (SSRF) in Gitea - CVE-2026-58442
Published: July 14, 2026
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information from internal-only Git services via server-side request forgery.
The vulnerability exists due to improper access control in services/migrations/migrate.go when validating repository migration destinations that resolve to multiple IP addresses. A remote user can use an attacker-controlled DNS hostname that resolves to both allowed and blocked addresses to disclose sensitive information from internal-only Git services via server-side request forgery.
The issue arises because the validation accepts a hostname if any resolved IP is allowed, while the later git clone operation performs DNS resolution again and can connect to a blocked internal address.