CVE-2026-34966
Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata
Published Jul 21, 2026 · updated Oct 14, 2026
### Summary Gitea has robust SSRF protection via for webhook and migration clone URLs, which validates resolved IPs at the TCP dial level. However, three code paths use raw (Go's ) which completely bypasses this protection, enabling SSRF to internal services and local file read via the scheme. ### Vulnerable Code **File: (line 32) -- Core vulnerability** **Callers in migration path:** - -- for release assets - -- for PR patches **File: (lines 312, 453)** **File: (line 306)** **Contrast with protected migration clone (same codebase):** ### PoC ### Impact - **Cloud metadata theft:** reachable via unfiltered (AWS IMDSv1 credentials, GCP tokens) - **Local file read:** scheme in reads (database credentials, JWT signing secrets, SMTP passwords) - **Internal service scanning:** Reach , , , networks - **Bypasses existing SSRF protection:** The dialer is comprehensive but only applied to webhook and clone transports -- these three paths are unprotected - Migration vectors require migration permission (admin/org owner); OAuth vector requires admin-configured custom OAuth2 source
Timeline
Detection, updates, and resolution for this record.
Jul 21, 2026 · GitHub Advisory Database
Detected
### Summary Gitea has robust SSRF protection via for webhook and migration clone URLs, which validates resolved IPs at the TCP dial level. However, three code paths use raw (Go's ) which completely bypasses this protection, enabling SSRF to internal services and local file read via the scheme. ### Vulnerable Code **File: (line 32) -- Core vulnerability** **Callers in migration path:** - -- for rel
Oct 14, 2026 · GitHub Advisory Database
Fix available
code.gitea.io/gitea fixed in 1.27.0; gitea.dev fixed in 1.27.0
Oct 14, 2026 · GitHub Advisory Database
Fix available
code.gitea.io/gitea fixed in 1.27.0
Oct 14, 2026 · GitHub Advisory Database
Fix available
gitea.dev fixed in 1.27.0
Oct 14, 2026 · GitHub Advisory Database
Fix available
gitea.dev fixed in 1.27.0
Oct 14, 2026 · GitHub Advisory Database
Updated
### Summary Gitea has robust SSRF protection via for webhook and migration clone URLs, which validates resolved IPs at the TCP dial level. However, three code paths use raw (Go's ) which completely bypasses this protection, enabling SSRF to internal services and local file read via the scheme. ### Vulnerable Code **File: (line 32) -- Core vulnerability** **Callers in migration path:** - -- for rel
Affected
- Go code.gitea.io/gitea0 → 1.27.0
- Go gitea.dev0 → 1.27.0
Sources
- CVE.orgCVE-2026-34966
Official CVE identifier
cve.org - FIRST EPSSCVE-2026-34966
30-day exploitation probability 0.4%
first.org - GitHub Advisory DatabaseGHSA-2wm4-vwp6-v7xc
GitHub Advisory Database record mirrored by OSV.
github.com - OSV.devGHSA-2wm4-vwp6-v7xc
Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata
osv.dev - OSV.devGO-2026-6039
Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata in gitea.dev
osv.dev