CVE-2026-70357

Gitea: server-side request forgery

Risk score: 53/100
CVSS: 7.5 v3.1
Exploit chance (30 days): 0.3%
Published: 6 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: Gitea validates a repository migration hostname against its network allow and block lists before invoking Git, but the Git subprocess independently resolves the hostname when connecting. An attacker who can start a migration and control the destination's DNS can change the address between validation and connection to …
Affected: Gitea
Fix: Apply the vendor's security update; see the linked advisory.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Gitea: Amber, patch this week. Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather than the pull request author. For pull_request activity triggered by a maintainer during ordinary triage, such as adding a label, the run was created without requiring approval, while the workflow def…

The flaws

CVE-2026-70357: Server-side request forgery (CVSS 7.5 · EPSS 0%)
CVE-2026-94205: Incorrect authorisation (CVSS 9.8 · EPSS 0%)
CVE-2026-60004: Gitea Code Injection Vulnerability (exploited)
CVE-2026-73278: Authentication bypass (CVSS 9.8 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Gitea

Where it stands

Exploited in the wild
On CISA's exploited list since 25 Aug
US federal deadline 28 Aug

How it unfolded

25 Aug, CISA (official): Added to the Known Exploited Vulnerabilities list
28 Aug, Deadline (official): US federal agencies must have patched

Connects to

Same weakness: Server-side request forgery (CWE-918). 221 other warnings in 30 days
Same product: Earlier Gitea warnings. 25 in the last 90 days

Why it is Yellow

CVSS 7.5 high
Remotely exploitable without logging in

References

Original description

Gitea validates a repository migration hostname against its network allow and block lists before invoking Git, but the Git subprocess independently resolves the hostname when connecting. An attacker who can start a migration and control the destination's DNS can change the address between validation and connection to reach a blocked internal address. The affected path is the Git clone operation; validation in the migration HTTP client's dialer does not protect the independently connecting Git subprocess.

Last activity 6 Oct 2026. Patch Forecast updates every hour.