CVE-2026-109553

Received Received - Intake

SSH Certificate Principal Spoofing in Gitea

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: Gitea Limited

Description

Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. When Gitea trusts a user certificate authority (`SSH_TRUSTED_USER_CA_KEYS`) and accepts arbitrary principals (`SSH_AUTHORIZED_PRINCIPALS_ALLOW=anything`), a user could register another user's public key line as their own principal, or a holder of a certificate signed by that authority could list it, and then authenticate as the owner of that key through the HTTP signature API and the built-in SSH server. Instances that do not trust a user certificate authority are not affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-18

Generated

2026-10-19

AI Q&A

2026-10-19

EPSS Evaluated

N/A

NVD

CVE-2026-109553

Affected Vendors & Products

Vendor	Product	Version / Range
Gitea	Gitea	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in Gitea involves improper handling of SSH certificates. When Gitea trusts a user certificate authority and allows arbitrary principals, an attacker could register another user's public key as their own principal. This allows them to authenticate as the key owner through the HTTP signature API or SSH server.

Detection Guidance

This vulnerability can be detected by checking if Gitea is configured to trust user certificate authorities (SSH_TRUSTED_USER_CA_KEYS) and accepts arbitrary principals (SSH_AUTHORIZED_PRINCIPALS_ALLOW=anything). Review Gitea's configuration files for these settings. No specific commands are provided in the context.

Impact Analysis

An attacker could impersonate another user by registering their public key as a principal. This could lead to unauthorized access to repositories, data breaches, or privilege escalation within Gitea instances that trust user certificate authorities.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using Gitea with SSH certificate trust may face compliance failures due to potential data exposure.

Mitigation Strategies

Disable SSH certificate authority trust by removing entries from SSH_TRUSTED_USER_CA_KEYS and set SSH_AUTHORIZED_PRINCIPALS_ALLOW to a restricted value instead of 'anything'.

Hi! I’m here to help you understand CVE-2026-109553. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70