CVE-2026-96400

Analyzed Analyzed - Analysis Complete

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-13

Assigner: Gitea Limited

Description

With `[migrations] ALLOWED_DOMAINS` set to a matching entry such as `*` or a hostname wildcard, Gitea's migration URL validation could permit reserved and link-local addresses, such as `169.254.169.254`, even when `ALLOW_LOCALNETWORKS = false`. The local-network block list did not cover these ranges, and a hostname matching the allow list was accepted regardless of its resolved address. A user who can start migrations on such an instance could reach these addresses from the Gitea server; the default empty `ALLOWED_DOMAINS` configuration is not affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-96400

EUVD

EUVD-2026-93922

Affected Vendors & Products

Vendor	Product	Version / Range
gitea	gitea	to 28.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This vulnerability involves Gitea's migration URL validation when the ALLOWED_DOMAINS setting includes wildcards like * or hostnames. It allows reserved and link-local IP addresses such as 169.254.169.254 to bypass restrictions even when ALLOW_LOCALNETWORKS is false. The issue occurs because the local-network block list does not cover these IP ranges, enabling users to access them from the Gitea server during migrations.

Detection Guidance

Check Gitea configuration for [migrations] ALLOWED_DOMAINS set to wildcard entries like * or hostnames that could match reserved/link-local addresses (e.g., 169.254.169.254). Inspect resolved addresses of allowed domains to ensure they do not include these ranges.

Impact Analysis

If you manage a Gitea instance with ALLOWED_DOMAINS set to a wildcard or matching hostname, an attacker with migration privileges could access internal or restricted network addresses like 169.254.169.254. This could lead to unauthorized access to services or data on those addresses, potentially compromising server security or exposing sensitive information.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized network access to sensitive systems. For GDPR, it may lead to unauthorized data exposure. For HIPAA, it could permit access to protected health information. Organizations must ensure network access controls are properly enforced to maintain compliance.

Mitigation Strategies

Set [migrations] ALLOWED_DOMAINS to an empty list or specific trusted domains. Ensure ALLOW_LOCALNETWORKS is set to true to block local network access. Review and restrict migration URL validation rules to exclude reserved and link-local addresses.

Hi! I’m here to help you understand CVE-2026-96400. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70