Patch Forecast
Amber warning
Patch this week.

CVE-2026-103059

When Gitea's built-in SSH server is enabled (`START_SSH_SERVER = true`), the presented public key…

Risk score
63/100
CVSS
9.1 v3.1
Exploit chance (30 days)
0.3%
Published
6 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
When Gitea's built-in SSH server is enabled (START_SSH_SERVER = true), the presented public key was looked up with an SQL LIKE comparison of its encoded content, which is case-insensitive on some databases, including the default SQLite. An attacker who can construct a case variant of another user's registered RSA publ…
Affected
Gitea
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Story map

Story map: GiteaTHE FLAWSTHE FIXCVE-2026-103059When Gitea's built-in SSHserver is enabled(`START_SSH_SERVER =…CVSS 9.1 · EPSS 0%CVE-2026-94205Incorrect authorisationCVSS 9.8 · EPSS 0%CVE-2026-60004Gitea Code InjectionVulnerabilityexploitedCVE-2026-73278Authentication bypassCVSS 9.8 · EPSS 0%FixApply the vendor's securityupdate; see the linked advisory.Who is exposedGiteaAMBER · PATCH THIS WEEKGiteaGitea Actions decided whether afork pull request run neededapproval based on the user whotriggered the event rather thanthe pull request author. Forpull_request activity triggeredby a maintainer during ordinary…Where it standsExploited in the wildOn CISA's exploited list since 25 AugUS federal deadline 28 AugHOW IT UNFOLDEDOfficial record on the left, the press on the right, oldest first.25 Aug · CISAAdded to the Known Exploited Vulnerabilities list28 Aug · DeadlineUS federal agencies must have patchedCONNECTS TOSame weaknessCWE-305 (CWE-305)5 other warnings in 30 days →Same productEarlier Gitea warnings25 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Gitea: Amber, patch this week. Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather than the pull request author. For pull_request activity triggered by a maintainer during ordinary triage, such as adding a label, the run was created without requiring approval, while the workflow def…

The flaws

  • CVE-2026-103059: When Gitea's built-in SSH server is enabled (`START_SSH_SERVER = true`), the presented public key… (CVSS 9.1 · EPSS 0%)
  • CVE-2026-94205: Incorrect authorisation (CVSS 9.8 · EPSS 0%)
  • CVE-2026-60004: Gitea Code Injection Vulnerability (exploited)
  • CVE-2026-73278: Authentication bypass (CVSS 9.8 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Gitea

Where it stands

  • Exploited in the wild
  • On CISA's exploited list since 25 Aug
  • US federal deadline 28 Aug

How it unfolded

  1. 25 Aug, CISA (official): Added to the Known Exploited Vulnerabilities list
  2. 28 Aug, Deadline (official): US federal agencies must have patched

Connects to

Why it is Amber

  • CVSS 9.1 critical
  • Remotely exploitable without logging in

References

Original description

When Gitea's built-in SSH server is enabled (`START_SSH_SERVER = true`), the presented public key was looked up with an SQL `LIKE` comparison of its encoded content, which is case-insensitive on some databases, including the default SQLite. An attacker who can construct a case variant of another user's registered RSA public key for which they can derive the private key could have that key matched to the victim's account and authenticate over SSH as that user. Keys are now looked up by fingerprint.

Last activity 6 Oct 2026. Patch Forecast updates every hour.