Vulnerability · Published Oct 6, 2026 · Assigned by Gitea

CVE-2026-101029Gitea migration and pull mirror SSRF through multi-answer DNS

Medium 4.3

In plain English

A medium-severity server-side request forgery in Gitea from Gitea. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 92.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Gitea's repository migration and pull mirror egress checks could be bypassed with a hostname that returns multiple DNS answers, because the address that was validated was not necessarily the address Git later connected to. A low-privileged user who can create migrations or mirrors could direct the server to internal services, reading from and writing to reachable internal Git or HTTP endpoints. Content from internal responses could additionally be disclosed through migration and mirror error messages.

Affected products (as reported)

Vendor	Product	Versions
Gitea	Gitea	0 – through 1.27.3

Weakness: CWE-209, CWE-367, CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

GitHub Security Advisory GHSA-6g2h-xpg3-rm48 vendor-advisory
Fix: go-gitea/gitea pull request #39010 patch
Fix: go-gitea/gitea pull request #39426 patch
Gitea 28.0.0 release announcement release-notes
go-gitea/gitea v28.0.0 release release-notes