CVE-2026-34966 Details
Description
Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply arbitrary URLs through release asset download URLs, pull-request patch URLs, or OAuth avatar endpoints to reach internal services, cloud instance-metadata endpoints, or read local files such as the application configuration containing database credentials and signing secrets, with exfiltrated content persisted as migration release assets for later retrieval.
A server-side request forgery (SSRF) vulnerability has been identified in Gitea versions prior to 1.27.0. This vulnerability allows authenticated attackers to bypass existing SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths. These operations use Go's default http.Get() without a custom DialContext, creating a blind spot in SSRF defenses. Attackers can inject arbitrary URLs through release asset download URLs, pull-request patch URLs, or OAuth avatar endpoints. This exploitation can reach internal services, access cloud instance-metadata endpoints, or read local files such as the application configuration, which contains sensitive database credentials and signing secrets. The exfiltrated content is then persisted as migration release assets for later retrieval.
Users can upgrade to Gitea version 1.27.0 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 5, 2026CISA-ADP
Assessed Aug 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/go-gitea/gitea/security/advisories/GHSA-2wm4-vwp6-v7xc | CISA-ADP | AdvisoryBundleExploitRemedyTechnical DescriptionVendor |
| https://github.com/go-gitea/gitea | [email protected] | Source CodeVendor |
| https://github.com/go-gitea/gitea/commit/b969123b7fac51c88daab5cb64e5b2f4abd53288 | [email protected] | Source CodeVendor |
| https://github.com/go-gitea/gitea/security/advisories/GHSA-2wm4-vwp6-v7xc | [email protected] | AdvisoryBundleExploitRemedyTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/gitea-prior-to-ssrf-via-migration-uri-fetch-bypass | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Gitea | <= 1.26.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 6, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | New CVE Received | [email protected] |