SSRF Vulnerabilities in Gitea 1.26.2

Executive Summary

CVE-2026-58314 involves two Server-Side Request Forgery (SSRF) vulnerabilities in Gitea versions up to 1.26.4. The first is a High severity issue (CVSS 8.6) where an IP classifier fails to block non-routable addresses like CGNAT (100.64.0.0/10), allowing authenticated users to target internal hosts via webhooks or repository migrations. The second is a Medium severity issue (CVSS 5.8) in the OpenID sign-in process, enabling unauthenticated SSRF attacks against internal IPs due to an unfiltered HTTP client.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Gitea instance is running a version prior to 1.27.0. Inspect webhook configurations and repository migration logs for unusual internal IP targets, especially CGNAT ranges like 100.64.0.0/10. Review OpenID sign-in logs for unexpected HTTP requests to internal addresses.

Useful 0 Not Useful 0

Impact Analysis

The High severity SSRF could expose sensitive HTTP responses (up to 1 MB) in logs or webhook delivery pages if exploited by authenticated users. The Medium severity SSRF allows unauthenticated attackers to access internal systems, potentially leaking internal data or enabling further attacks. Both vulnerabilities can be exploited in default configurations.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to internal systems, potentially exposing sensitive data. This may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information, depending on the data involved. Organizations must address this to maintain compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Gitea to version 1.27.0 or later immediately. Review and restrict webhook configurations to prevent SSRF attacks. Ensure OpenID client configurations filter internal IP requests. Monitor logs for suspicious activity targeting internal networks.

Useful 0 Not Useful 0