CVE-2026-89430
Gitea: server-side request forgery
- Risk score
- 50/100
- CVSS
- 8.1 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 6 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Gitea validated a push mirror's remote address against the [migrations] allow and block lists only when the mirror was created. Each synchronization passed the stored address directly to git push, so a name that later resolved to a blocked or internal address was still reached. A user with administrator access to a re…
- Affected
- Gitea
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.1 high
References
Original description
Gitea validated a push mirror's remote address against the `[migrations]` allow and block lists only when the mirror was created. Each synchronization passed the stored address directly to `git push`, so a name that later resolved to a blocked or internal address was still reached. A user with administrator access to a repository, which includes repositories they create themselves, could aim push mirror synchronization at internal Git services and force-push the repository's contents to them.
Last activity 6 Oct 2026. Patch Forecast updates every hour.