CVE-2026-101027
When was configured, a hostname matching the allow list was accepted without checking its resolved address against the local-network restrictions.
Published Oct 6, 2026 · updated Oct 15, 2026 · gitea gitea
When was configured, a hostname matching the allow list was accepted without checking its resolved address against the local-network restrictions. A user who can start repository migrations and control the DNS of an allowed hostname could make it resolve to loopback or private addresses and bypass , reaching internal services from the Gitea server. Instances without configured are not affected by this specific bypass.
Timeline
Detection, updates, and resolution for this record.
Oct 6, 2026 · NIST NVD
Detected
When was configured, a hostname matching the allow list was accepted without checking its resolved address against the local-network restrictions. A user who can start repository migrations and control the DNS of an allowed hostname could make it resolve to loopback or private addresses and bypass , reaching internal services from the Gitea server. Instances without configured are not affected by
Oct 15, 2026 · NIST NVD
Updated
When was configured, a hostname matching the allow list was accepted without checking its resolved address against the local-network restrictions. A user who can start repository migrations and control the DNS of an allowed hostname could make it resolve to loopback or private addresses and bypass , reaching internal services from the Gitea server. Instances without configured are not affected by
Affected
- cpe gitea/giteaversion unspecified
Sources
- CVE.orgCVE-2026-101027
Official CVE identifier
cve.org - NIST NVDCVE-2026-101027
When was configured, a hostname matching the allow list was accepted without checking its resolved address against the local-network restrictions. A user who can start repository migrations and control the DNS of an allowed hostname could make it re
nvd.nist.gov