All vulnerabilities
CVE-2026-101027GHSA-fqjr-23c8-gg9m

Gitea migration SSRF through ALLOWED_DOMAINS address check bypass

Gitea Gitea
Open in ThreatlineRecord JSON
CVSS
7.7High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in28.0.0Fixed versionGitHub
Published6 Oct 2026Updated 7 Oct 2026CVE List

What fixes it

  • 28.0.0gitea.dev, goGitHubgo get gitea.dev@v28.0.0

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

When [migrations] ALLOWED_DOMAINS was configured, a hostname matching the allow list was accepted without checking its resolved address against the local-network restrictions. A user who can start repository migrations and control the DNS of an allowed hostname could make it resolve to loopback or private addresses and bypass ALLOW_LOCALNETWORKS = false, reaching internal services from the Gitea server. Instances without ALLOWED_DOMAINS configured are not affected by this specific bypass.

Text from CVE List

Affected versions 2

  • Giteaaffected: all versions through 1.27.3CVE List
  • gitea.dev, go<= 1.27.3GitHub

References 4