SSRF in Migration Asset Downloads Bypasses hostmatcher

Executive Summary

CVE-2026-59765 is a Server-Side Request Forgery (SSRF) vulnerability in Gitea that allows attackers to bypass hostmatcher protections and read internal files or cloud metadata. It occurs because three code paths use raw http.Get() calls without proper IP validation, enabling SSRF attacks against internal services and local file reads via file:// scheme.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability cannot be directly detected via commands as it involves application-level SSRF bypasses in Gitea. However, you can check for signs of exploitation by monitoring logs for unusual migration-related activities, file access attempts, or cloud metadata requests. Review Gitea logs for unauthorized access to internal files or external URLs.

Useful 0 Not Useful 0

Impact Analysis

Attackers with migration permissions or OAuth access could exploit this to steal cloud metadata like AWS IMDSv1 credentials or GCP tokens. They could also read sensitive local files such as /etc/gitea/app.ini, which contains database credentials and secrets.

Useful 0 Not Useful 0

Compliance Impact

This SSRF vulnerability could lead to unauthorized access to sensitive data, including cloud metadata and local files containing secrets. For GDPR, this may result in breaches of personal data confidentiality. For HIPAA, exposure of internal files or cloud metadata could compromise protected health information. Compliance violations may occur if such breaches are not prevented.

Useful 0 Not Useful 0

Mitigation Strategies

Update Gitea to the latest patched version to address the SSRF vulnerability in migration asset downloads. Review and restrict migration permissions to only necessary admin/org owners. Inspect OAuth configurations for malicious URLs and remove any unauthorized entries. Monitor network traffic for unusual requests to internal services or cloud metadata endpoints.

Useful 0 Not Useful 0