CVE-2026-34966

Received Received - Intake

Server-Side Request Forgery in Gitea Prior to 1.27.0

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: VulnCheck

Description

Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply arbitrary URLs through release asset download URLs, pull-request patch URLs, or OAuth avatar endpoints to reach internal services, cloud instance-metadata endpoints, or read local files such as the application configuration containing database credentials and signing secrets, with exfiltrated content persisted as migration release assets for later retrieval.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-05

Last Modified

2026-08-05

Generated

2026-08-06

AI Q&A

2026-08-06

EPSS Evaluated

N/A

NVD

CVE-2026-34966

EUVD

EUVD-2026-53617

Affected Vendors & Products

Vendor	Product	Version / Range
gitea	gitea	to 1.27.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

Gitea versions before 1.27.0 have a server-side request forgery (SSRF) flaw. Authenticated attackers can bypass SSRF protections by manipulating HTTP fetch operations during migrations or OAuth avatar handling. The issue stems from Go's default http.Get function lacking a custom DialContext, allowing arbitrary URL access. Attackers can target internal services, cloud metadata endpoints, or local files like app configs containing sensitive data such as database credentials.

Detection Guidance

Detecting this vulnerability requires checking for Gitea instances running versions prior to 1.27.0. Inspect server logs for unusual HTTP fetch operations, especially from authenticated users, targeting internal services or local files. Look for suspicious release asset downloads, pull-request patch URLs, or OAuth avatar endpoint accesses.

Impact Analysis

If you run a vulnerable Gitea instance, attackers could access internal systems, steal secrets like database credentials or signing keys, or exfiltrate data via crafted URLs in release assets or OAuth avatars. The stolen data may be stored as migration release assets for later retrieval, posing ongoing risks.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. A breach may result in legal penalties, reputational damage, and loss of compliance certifications.

Mitigation Strategies

Upgrade Gitea to version 1.27.0 or later immediately. Review and restrict access to internal services and local files. Monitor network traffic for unauthorized HTTP fetch operations. Disable or audit OAuth avatar endpoints and migration features until patched.

Hi! I’m here to help you understand CVE-2026-34966. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70