CVE-2026-101027

Analyzed Analyzed - Analysis Complete

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-15

Assigner: Gitea Limited

Description

When `[migrations] ALLOWED_DOMAINS` was configured, a hostname matching the allow list was accepted without checking its resolved address against the local-network restrictions. A user who can start repository migrations and control the DNS of an allowed hostname could make it resolve to loopback or private addresses and bypass `ALLOW_LOCALNETWORKS = false`, reaching internal services from the Gitea server. Instances without `ALLOWED_DOMAINS` configured are not affected by this specific bypass.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-101027

EUVD

EUVD-2026-93908

Affected Vendors & Products

Vendor	Product	Version / Range
gitea	gitea	to 28.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-346	The product does not properly verify that the source of data or communication is valid.

Attack-Flow Graph

Executive Summary

This vulnerability involves a bypass in Gitea's repository migration restrictions. When the ALLOWED_DOMAINS setting is configured, a hostname on the allow list could be manipulated via DNS to resolve to loopback or private addresses. This allows an attacker who controls DNS and can initiate migrations to bypass the ALLOW_LOCALNETWORKS restriction and access internal services from the Gitea server.

Detection Guidance

To detect this vulnerability, check Gitea's configuration for `[migrations] ALLOWED_DOMAINS` settings. Verify if DNS resolution of allowed hostnames bypasses local-network restrictions by testing if loopback or private addresses are accepted. Inspect Gitea logs for migration attempts to unexpected addresses.

Impact Analysis

If you run a Gitea instance with ALLOWED_DOMAINS configured, an attacker could exploit this to access internal services that should be restricted. This could lead to unauthorized access to sensitive data or systems, depending on your network configuration and the services running internally.

Compliance Impact

This vulnerability could lead to unauthorized access to internal systems, potentially violating data protection requirements under GDPR or HIPAA. If internal services store or process regulated data, unauthorized access could result in compliance breaches, data leaks, or legal penalties.

Mitigation Strategies

Ensure ALLOWED_DOMAINS is not configured or verify that hostnames resolve to allowed addresses. Disable ALLOW_LOCALNETWORKS if not needed. Review DNS configurations for allowed domains to prevent loopback or private IP resolutions.

Hi! I’m here to help you understand CVE-2026-101027. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70