CVE-2026-119545
Deferred Deferred - Pending Action

Server-Side Request Forgery in Forgejo

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server issue requests by submitting arbitrary OpenID identifier URLs. Attackers can POST crafted identifiers to /user/login/openid to trigger blind discovery GET requests to loopback, cloud metadata, and internal addresses for port scanning and probing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119545
EUVD
EUVD-2026-113810

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
forgejo forgejo 0
forgejo forgejo 16.0.0
forgejo forgejo 17.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Forgejo versions up to 15.0.11, 16.0.0 to 16.0.7, and 17.0.0 to 17.0.1 have a server-side request forgery (SSRF) vulnerability. Unauthenticated attackers can exploit this by submitting arbitrary OpenID identifier URLs to the /user/login/openid endpoint. This causes the server to make blind discovery GET requests to loopback addresses, cloud metadata services, and internal network addresses, enabling port scanning and probing of internal systems.

Detection Guidance

To detect this vulnerability, monitor network traffic for suspicious POST requests to /user/login/openid with arbitrary OpenID identifiers. Check server logs for blind discovery GET requests to loopback, cloud metadata, or internal addresses. Use tools like curl to test if the server issues requests to internal targets.

Impact Analysis

This vulnerability allows attackers to scan internal networks, probe cloud metadata services, and access loopback interfaces. It could expose sensitive internal services, enable reconnaissance for further attacks, or lead to unauthorized access to internal resources. The impact includes potential data breaches, service disruption, and increased risk of follow-on attacks.

Mitigation Strategies

Immediately upgrade Forgejo to a patched version (15.0.12 or later, 16.0.8 or later, or 17.0.2 or later). If upgrading is not possible, restrict access to the /user/login/openid endpoint via firewall rules or reverse proxy configurations to prevent unauthenticated requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119545. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart