Time-of-check Time-of-use (TOCTOU) Race Condition in Gitea - CVE-2026-58508
Published: July 14, 2026
Vulnerability identifier: #VU137446
CSH Severity: Low
CVSS v4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-58508
CWE-ID: CWE-367
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to access internal network resources via server-side request forgery.
The vulnerability exists due to improper access control in services/migrations/migrate.go when processing migration URLs. A remote user can supply a URL that passes the initial DNS-based check and then rebind DNS resolution to access internal network resources via server-side request forgery.
Exploitation requires control over DNS responses for the target host and relies on rebinding between the validation step and the subsequent git fetch operation.
Affected software
Gitea
How to mitigate CVE-2026-58508
Install security update from vendor's website.
Gitea - update to 1.27.0