VulnSocial

CVE-2026-101029(gitea / gitea)

LOWCVSS 4.3 · MEDIUM

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Gitea's repository migration and pull mirror egress checks could be bypassed with a hostname that returns multiple DNS answers, because the address that was validated was not necessarily the address Git later connected to. A low-privileged user who can create migrations or mirrors could direct the server to internal services, reading from and writing to reachable internal Git or HTTP endpoints. Content from internal responses could additionally be disclosed through migration and mirror error messages.

gitea CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Exploit / PoC references
Other references
Weakness type (CWE)
CWE-209CWE-367CWE-918

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • gitea

Affected systems

Vendors
gitea
Products
gitea

Deep dive

Full discourse1 post
  • iototsecnews@iototsecnews

    Gitea の 27件の脆弱性が FIX：深刻な SSH 認証バイパスや SSRF の恐れ https://iototsecnews.jp/2026/10/08/gitea-patches-27-security-flaws-including-critical-ssh-authentication-bypass-and-ssrf/ Gitea 製コード管理プラットフォームにおける深刻な欠陥 CVE-2026-103059 について解説する記事です。認証処理の不備や検証機能の欠落に伴い、他者への成りすまし／内部ネットワークへの不正アクセス／承認回避によるプログラム実行といった不具合が生じる危険性があります。対象となる CVE は CVE-2026-103059／CVE-2026-70357／CVE-2026-101027／CVE-2026-101029／CVE-2026-89430／CVE-2026-104632／CVE-2026-94205 です。対象となる製品は Gitea です。対応策として修正版への更新／ネットワークルールの見直しが求められます。 #Gitea #CVE2026103059 #CVE2026103059 #CVE202670357 #CVE2026101027 #CVE2026101029 #CVE202689430 #CVE2026104632 #CVE202694205

    0100089
    518 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appgiteagitea---

Explore more

Back to dashboardgitea CVEsgitea vulnerabilities