Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Soft Serve is a self-hostable Git server for the command line. From version 0.6.0 to before version 0.11.4, an authenticated SSH user can force the server to make HTTP requests to internal/private IP addresses by running repo import with a crafted --lfs-endpoint URL. The initial batch request is blind (the response from a metadata endpoint won't parse as valid LFS JSON), but an attacker hosting a fake LFS server can chain this into full read access to internal services by returning download URLs that point at internal targets. This issue has been patched in version 0.11.4.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-07 | 4 | Disclosure2General1Patch1 |
| 2026-03-08 | 1 | Disclosure1 |
| 2026-03-12 | 2 | Disclosure2 |
| 2026-03-23 | 1 | Disclosure1 |
CVE-2026-30832 Server-Side Request Forgery in Soft Serve Git Server via Authenticated LFS Import https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-30832
Post summary
The text references CVE-2026-30832 as an SSRF vulnerability in Soft Serve Git Server via authenticated LFS import, providing only a brief headline with no supporting details about exploits, mitigations, or active usage.
Vulnerability in `soft-serve` allows SSRF via unvalidated LFS endpoint in repo import (CVE-2026-30832). Potential internal network access. #SSRF #GitLFS #infosec https://www.pulsepatch.io/posts/cve-2026-30832-soft-serve-ssrf-vulnerability
Post summary
The post discloses an SSRF flaw in soft‑serve’s Git LFS endpoint that could expose internal network resources; it does not confirm exploit code, active attacks, or a fix.
CVE-2026-30832 (CVSS:9.1, CRITICAL) is Analyzed. Soft Serve is a self-hostable Git server for the command line. From version 0.6.0 to before version 0.11.4, an authentic..https://nvd.nist.gov/vuln/detail/CVE-2026-30832 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The tweet announces a critical vulnerability (CVE-2026-30832) in Soft Serve Git server, noting affected versions and referencing the NVD link, without providing PoC, exploit, mitigation, or active exploitation details.
🔴 Soft Serve, Server-Side Request Forgery (SSRF), #CVE-2026-30832 (Critical) https://dailycve.com/soft-serve-server-side-request-forgery-ssrf-cve-2026-30832-critical/
Post summary
A new, critical server‑side request forgery vulnerability (CVE‑2026‑30832) has been disclosed, with no indicated exploitation or patch availability yet.
🔴 CVE-2026-30832 - Critical Soft Serve is a self-hostable Git server for the command line. From version 0.6.0 to before version 0.11.4, an authenticated SSH user can force the server to make HTTP requests to interna... https://www.thehackerwire.com/vulnerability/CVE-2026-30832/ https://t.co/TpIADuFHNd
Post summary
Soft Serve’s self-hostable Git server has a critical authentication‑related flaw that allows an authenticated SSH user to trigger internal HTTP requests; no evidence of exploitation, PoC, or patch info is provided.
CVE-2026-30832 Soft Serve is a self-hostable Git server for the command line. From version 0.6.0 to before version 0.11.4, an authenticated SSH user can force the server to make HTT… https://www.cve.org/CVERecord?id=CVE-2026-30832
Post summary
The tweet reveals that CVE-2026‑30832 allows an authenticated SSH user to compel Soft Serve to make outbound HTTP requests, providing limited technical details but no PoC, exploit, patch or active exploitation information.
[CVE-2026-30832: CRITICAL] Attention Soft Serve users! Prior to version 0.11.4, a vulnerability allowed attackers to force HTTP requests to internal IPs. Update to the latest version for a secure Git server.#cve,CVE-2026-30832,#cybersecurity https://cvefind.com/CVE-2026-30832
Post summary
The message announces that CVE-2026-30832, a critical vulnerability in Soft Serve, allows attackers to force HTTP requests to internal IPs. Users are urged to update to version 0.11.4 or later to remediate the issue.
🚨 CVE-2026-30832: Soft Serve: SSRF via unvalidated... Blind SSRF escalates to full internal network read via malicious LFS server returning crafted download URLs pointing at... https://zerodaysignal.com/vulnerability/CVE-2026-30832 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The tweet announces CVE-2026-30832, a blind SSRF vulnerability in Soft Serve that can be leveraged for full internal network read, and provides a link likely containing technical details and possible PoC. No active exploitation, patch, or false‑positive information is discussed.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | charm | soft_serve | - | go | - |