CVE-2026-101027: Gitea migration SSRF through ALLOWED_DOMAINS address check bypass
When [migrations] ALLOWEDDOMAINS was configured, a hostname matching the allow list was accepted without checking its resolved address against the local-network restrictions. A user who can start repository migrations and control the DNS of an allowed hostname could make it resolve to loopback or private addresses and bypass ALLOWLOCALNETWORKS = false, reaching internal services from the Gitea server. Instances without ALLOWEDDOMAINS configured are not affected by this specific bypass.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this bypass?
The affected configuration is one where [migrations] ALLOWED_DOMAINS is configured and ALLOW_LOCALNETWORKS is set to false. Instances without ALLOWED_DOMAINS configured are not affected by this specific bypass.
What access and control does an attacker need?
An attacker must be able to start repository migrations and control DNS for a hostname that matches the configured allow list. They can then resolve that allowed hostname to a loopback or private address.
What could exploitation allow?
Exploitation can cause the Gitea server to reach internal services at loopback or private network addresses through a repository migration request, despite ALLOW_LOCALNETWORKS being false.