ZeroDay Findings
Sign inSign up

Findings

CVE-2026-34966

Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

Published Jul 21, 2026 · updated Oct 14, 2026

### Summary Gitea has robust SSRF protection via for webhook and migration clone URLs, which validates resolved IPs at the TCP dial level. However, three code paths use raw (Go's ) which completely bypasses this protection, enabling SSRF to internal services and local file read via the scheme. ### Vulnerable Code **File: (line 32) -- Core vulnerability** **Callers in migration path:** - -- for release assets - -- for PR patches **File: (lines 312, 453)** **File: (line 306)** **Contrast with protected migration clone (same codebase):** ### PoC ### Impact - **Cloud metadata theft:** reachable via unfiltered (AWS IMDSv1 credentials, GCP tokens) - **Local file read:** scheme in reads (database credentials, JWT signing secrets, SMTP passwords) - **Internal service scanning:** Reach , , , networks - **Bypasses existing SSRF protection:** The dialer is comprehensive but only applied to webhook and clone transports -- these three paths are unprotected - Migration vectors require migration permission (admin/org owner); OAuth vector requires admin-configured custom OAuth2 source

Timeline

Detection, updates, and resolution for this record.

  1. Jul 21, 2026 · GitHub Advisory Database

    Detected

    ### Summary Gitea has robust SSRF protection via for webhook and migration clone URLs, which validates resolved IPs at the TCP dial level. However, three code paths use raw (Go's ) which completely bypasses this protection, enabling SSRF to internal services and local file read via the scheme. ### Vulnerable Code **File: (line 32) -- Core vulnerability** **Callers in migration path:** - -- for rel

  2. Oct 14, 2026 · GitHub Advisory Database

    Fix available

    code.gitea.io/gitea fixed in 1.27.0; gitea.dev fixed in 1.27.0

  3. Oct 14, 2026 · GitHub Advisory Database

    Fix available

    code.gitea.io/gitea fixed in 1.27.0

  4. Oct 14, 2026 · GitHub Advisory Database

    Fix available

    gitea.dev fixed in 1.27.0

  5. Oct 14, 2026 · GitHub Advisory Database

    Fix available

    gitea.dev fixed in 1.27.0

  6. Oct 14, 2026 · GitHub Advisory Database

    Updated

    ### Summary Gitea has robust SSRF protection via for webhook and migration clone URLs, which validates resolved IPs at the TCP dial level. However, three code paths use raw (Go's ) which completely bypasses this protection, enabling SSRF to internal services and local file read via the scheme. ### Vulnerable Code **File: (line 32) -- Core vulnerability** **Callers in migration path:** - -- for rel

Affected

  • Go code.gitea.io/gitea0 → 1.27.0
  • Go gitea.dev0 → 1.27.0

Sources

  • CVE.orgCVE-2026-34966

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2026-34966

    30-day exploitation probability 0.4%

    first.org
  • GitHub Advisory DatabaseGHSA-2wm4-vwp6-v7xc

    GitHub Advisory Database record mirrored by OSV.

    github.com
  • OSV.devGHSA-2wm4-vwp6-v7xc

    Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

    osv.dev
  • OSV.devGO-2026-6039

    Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata in gitea.dev

    osv.dev

References