Improper Handling of Case Sensitivity in Gitea - CVE-2026-103059

Vulnerability details

The vulnerability allows a remote attacker to bypass SSH authentication as a user with a registered RSA public key and obtain read/write access to all repositories accessible to that user.

The vulnerability exists due to case-insensitive comparison of RSA public-key text in Gitea's built-in SSH server when matching presented keys against registered keys using SQLite LIKE prefix queries. A remote attacker can retrieve a victim's public key from /{username}.keys, change the case of base64 letters in its RSA modulus until the resulting modulus is prime, and derive a working private exponent to authenticate with the resulting look-alike key and access or modify the victim's repositories.

Affected software

How to mitigate CVE-2026-103059

External References

• https://github.com/go-gitea/gitea/security/advisories/GHSA-8pwg-hcgm-54cp

Related Security Bulletins

• Multiple vulnerabilities in Gitea