CVE-2026-89430

Undergoing Analysis Undergoing Analysis - In Progress

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-13

Assigner: Gitea Limited

Description

Gitea validated a push mirror's remote address against the `[migrations]` allow and block lists only when the mirror was created. Each synchronization passed the stored address directly to `git push`, so a name that later resolved to a blocked or internal address was still reached. A user with administrator access to a repository, which includes repositories they create themselves, could aim push mirror synchronization at internal Git services and force-push the repository's contents to them.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-89430

EUVD

EUVD-2026-93912

Affected Vendors & Products

Vendor	Product	Version / Range
gitea	gitea	to 28.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-367	The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This vulnerability in Gitea allows an administrator to bypass address restrictions for push mirrors. The system only checks if a mirror's remote address is allowed or blocked when the mirror is created. During synchronization, the stored address is passed directly to git push without revalidation. This means an administrator could later change the address to an internal or blocked service and still push repository contents there.

Detection Guidance

This vulnerability involves Gitea push mirrors not validating remote addresses during synchronization, allowing internal or blocked targets. To detect it, check Gitea logs for push mirror sync attempts to unexpected or internal addresses. Review repository settings for unauthorized push mirrors targeting internal Git services. Monitor network traffic for git push commands originating from Gitea to internal IPs or domains.

Impact Analysis

If you are a Gitea administrator, an attacker with repository access could exfiltrate your repository contents to unauthorized internal services. This could lead to data leaks, unauthorized code modifications, or compromise of internal systems if the pushed data contains sensitive information.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized data transfers to internal or external systems. GDPR requires data protection and prevents unauthorized access or transfer. HIPAA mandates secure handling of protected health information. Uncontrolled repository pushes may lead to data breaches, resulting in legal penalties and loss of trust.

Mitigation Strategies

Update Gitea to the latest version where this issue is fixed. Review repository push mirror configurations to ensure remote addresses are not pointing to internal or blocked services. Restrict administrator access to repositories as needed.

Hi! I’m here to help you understand CVE-2026-89430. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70