Vulnerability · Published Oct 6, 2026 · Assigned by Gitea

CVE-2026-104636Gitea SSRF through Git HTTP redirects in mirrors and fetches

High 7.5

In plain English

A high-severity server-side request forgery in Gitea from Gitea. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.3%top 82.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Gitea validated the initial remote URL for push mirrors, wiki remote checks, and fetches of migrated pull request heads, but the subsequent raw Git operations followed HTTP redirects without revalidating the destination. A repository administrator using a policy-allowed endpoint that redirects could make Gitea's Git client send requests to an address that the outbound host policy would otherwise block. The impact depends on the configured policy and the internal services reachable from the server.

Affected products (as reported)

Vendor	Product	Versions
Gitea	Gitea	0 – through 1.27.3

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

GitHub Security Advisory GHSA-g4hw-fg4c-89mq vendor-advisory
Fix: go-gitea/gitea pull request #39426 patch
Gitea 28.0.0 release announcement release-notes
go-gitea/gitea v28.0.0 release release-notes