Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Soft Serve is a self-hostable Git server for the command line. From version 0.6.0 to before version 0.11.6, an authorization flaw in repo import allows any authenticated SSH user to clone a server-local Git repository, including another user's private repo, into a new repository they control. This issue has been patched in version 0.11.6.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
Today I’m publishing CVE-2026-33353, a high severity (7.1) auth bypass vulnerability in Soft Serve that lets any authenticated user clone other users’ private repositories from the server. Upgrade to 0.11.6 to patch.
Post summary
The author publicly announces CVE-2026-33353, an auth‑bypass vulnerability in Soft Serve with a severity of 7.1, and recommends upgrading to version 0.11.6 to remediate it.
CVE-2026-33353 Authorization Bypass in Soft Serve Git Server Enables Repository Cloning https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-33353
Post summary
The text announces CVE‑2026‑33353, highlighting an authorization bypass in Soft Serve Git Server that allows repository cloning, but does not provide PoC, exploit details, or mitigation information.
An authenticated repo import flaw in `Soft Serve` (CVE-2026-33353) may permit cloning of server-local private repositories. Monitor official channels for patch availability. #InfoSec #CodeSecurity #Vulnerability https://www.pulsepatch.io/posts/cve-2026-33353-soft-serve-repo-import-vulnerability
Post summary
Soft Serve's CVE-2026-33353 is an authenticated repo import flaw that could allow cloning of private repositories; users should monitor official channels for the upcoming patch.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | charm | soft_serve | - | go | - |