Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Gitea can be tricked to contact blocked internal servers

CVE-2026-104636 · published 21 days ago
Summary

When Gitea follows a web link that redirects to another address, it does not check the new address before connecting. An administrator who can set a redirect URL could cause Gitea to reach internal services that your network policy is meant to keep off‑limits. Review and restrict any redirect URLs used in mirrors or fetches, or configure the server to validate all redirected locations.

What to do
  • Update gitea to version 28.0.0.
Affected software
Ecosystem VendorProductAffected versions
– gitea gitea <= 1.27.3
Bitnami – gitea < 28.0.0
Fix: upgrade to 28.0.0
Original advisory text
Gitea SSRF through Git HTTP redirects in mirrors and fetches
Gitea validated the initial remote URL for push mirrors, wiki remote checks, and fetches of migrated pull request heads, but the subsequent raw Git operations followed HTTP redirects without revalidating the destination. A repository administrator using a policy-allowed endpoint that redirects could make Gitea's Git client send requests to an address that the outbound host policy would otherwise block. The impact depends on the configured policy and the internal services reachable from the server.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published14 Oct 2026
Updated4 Nov 2026
First seen6 Oct 2026
Sources
CVE-2026-104636 · NVD
CVE-2026-104636 · MITRE
CVE-2026-104636 · OSV
GHSA-g4hw-fg4c-89mq · GHSA
BIT-gitea-2026-104636 · OSV
Track software like this
Free during beta