Server-Side Request Forgery (SSRF) in Gitea - CVE-2026-57894
Published: July 14, 2026
Vulnerability identifier: #VU137439
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N]
CVE-ID: CVE-2026-57894
CWE-ID: CWE-918
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information from internal Git repositories.
The vulnerability exists due to server-side request forgery (SSRF) in repository migration and pull mirror synchronization when processing a user-supplied Git URL that returns an HTTP redirect. A remote user can submit an allowed public Git URL that redirects to an internal Git HTTP(S) endpoint to disclose sensitive information from internal Git repositories.
Pull mirror configurations can cause scheduled fetch operations to continue retrieving future commits from the redirected internal repository.
Affected software
Gitea
How to mitigate CVE-2026-57894
Install security update from vendor's website.
Gitea - update to 1.27.0