All vulnerabilities
CVE-2026-109553GHSA-vcp6-2qc6-gvq3

Gitea SSH certificate principal impersonation of other users

Gitea Gitea
Open in ThreatlineRecord JSON
CVSS
7.5High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 8% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in28.2.0Fixed versionGitHub
Published18 Oct 2026Updated 20 Oct 2026CVE List

What fixes it

  • 28.2.0gitea.dev, goGitHubgo get gitea.dev@v28.2.0

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. When Gitea trusts a user certificate authority (SSH_TRUSTED_USER_CA_KEYS) and accepts arbitrary principals (SSH_AUTHORIZED_PRINCIPALS_ALLOW=anything), a user could register another user's public key line as their own principal, or a holder of a certificate signed by that authority could list it, and then authenticate as the owner of that key through the HTTP signature API and the built-in SSH server. Instances that do not trust a user certificate authority are not affected.

Text from CVE List

Affected versions 2

  • Giteaaffected: all versions through 28.1.0CVE List
  • gitea.dev, go<= 28.1.0GitHub

References 5