Gitea Actions Artifacts V4 HMAC Ambiguity

Publication date: 2026-07-03

Last updated on: 2026-07-03

Assigner: Gitea Limited

Description

Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-03

Last Modified

2026-07-03

Generated

2026-07-04

AI Q&A

2026-07-04

EPSS Evaluated

N/A

NVD

CVE-2026-58426

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-347	The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

Executive Summary

This vulnerability involves an ambiguity in the HMAC signing of Gitea Actions Artifacts V4 signed URLs. This ambiguity allows an attacker to read artifacts across different repositories and write upload states across different tasks.

Impact Analysis

The vulnerability can lead to unauthorized access to artifacts from other repositories and unauthorized modification of upload states in different tasks. This can compromise confidentiality and integrity of data within the affected system.

Hi! I’m here to help you understand CVE-2026-58426. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70