CVE-2026-34966: Gitea prior to 1.27.0 SSRF via Migration URI Fetch Bypass
Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply arbitrary URLs through release asset download URLs, pull-request patch URLs, or OAuth avatar endpoints to reach internal services, cloud instance-metadata endpoints, or read local files such as the application configuration containing database credentials and signing secrets, with exfiltrated content persisted as migration release assets for later retrieval.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Giteato a version that resolves this vulnerability.Fixed in 1.27.0 - Compensating control
If immediate upgrade is not possible, restrict outbound network access from the Gitea server (egress filtering) to prevent SSRF attempts from reaching internal services, cloud instance-metadata endpoints, or local file access targets.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34966?
CVE-2026-34966 has a severity rating of 7.6, indicating a high risk.
How do I fix CVE-2026-34966?
To fix CVE-2026-34966, upgrade Gitea to version 1.27.0 or later.
What types of attacks can CVE-2026-34966 facilitate?
CVE-2026-34966 can facilitate server-side request forgery (SSRF) attacks.
Who can exploit CVE-2026-34966?
Authenticated attackers can exploit CVE-2026-34966 due to its nature involving HTTP fetch operations.
What components of Gitea are affected by CVE-2026-34966?
CVE-2026-34966 affects migration and OAuth avatar code paths in Gitea prior to version 1.27.0.