LFS Authentication Bypass via Malformed SSH Sub-verb

Publication date: 2026-07-03

Last updated on: 2026-07-03

Assigner: Gitea Limited

Description

LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-03

Last Modified

2026-07-03

Generated

2026-07-04

AI Q&A

2026-07-04

EPSS Evaluated

N/A

NVD

CVE-2026-58423

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

This vulnerability involves an authentication bypass in the Large File Storage (LFS) system through a malformed SSH sub-verb. It allows unauthorized users to gain read access to private repositories.

Impact Analysis

The vulnerability can lead to unauthorized disclosure of sensitive or private data stored in private repositories, as attackers can bypass authentication and read repository contents without permission.

Hi! I’m here to help you understand CVE-2026-58423. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70