CVE-2026-103059

Analyzed Analyzed - Analysis Complete

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-15

Assigner: Gitea Limited

Description

When Gitea's built-in SSH server is enabled (`START_SSH_SERVER = true`), the presented public key was looked up with an SQL `LIKE` comparison of its encoded content, which is case-insensitive on some databases, including the default SQLite. An attacker who can construct a case variant of another user's registered RSA public key for which they can derive the private key could have that key matched to the victim's account and authenticate over SSH as that user. Keys are now looked up by fingerprint.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-103059

EUVD

EUVD-2026-93906

Affected Vendors & Products

Vendor	Product	Version / Range
gitea	gitea	to 28.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-305	The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.

Attack-Flow Graph

Executive Summary

This vulnerability affects Gitea's built-in SSH server when enabled. It involves a case-insensitive SQL LIKE comparison for public key lookups in some databases like SQLite. An attacker could exploit this by creating a case variant of a victim's RSA public key, matching it to the victim's account, and authenticating via SSH as that user.

Detection Guidance

To detect this vulnerability, check if Gitea's built-in SSH server is enabled by verifying the configuration setting START_SSH_SERVER=true in Gitea's configuration file. Inspect the SSH server logs for unusual authentication attempts or successful logins from unexpected public keys.

Impact Analysis

If you use Gitea with its SSH server enabled, an attacker could gain unauthorized access to your account by exploiting this vulnerability. They could impersonate you, access your repositories, or perform actions on your behalf without your knowledge.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR, HIPAA, or other regulations. It may result in data breaches, unauthorized data exposure, or failure to maintain proper access controls.

Mitigation Strategies

Disable Gitea's built-in SSH server by setting START_SSH_SERVER to false in the configuration file. Update Gitea to the latest version where keys are looked up by fingerprint instead of SQL LIKE comparison.

Hi! I’m here to help you understand CVE-2026-103059. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70