VulnSocial

CVE-2026-70357(gitea / gitea)

LOWCVSS 7.5 · HIGH

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Gitea validates a repository migration hostname against its network allow and block lists before invoking Git, but the Git subprocess independently resolves the hostname when connecting. An attacker who can start a migration and control the destination's DNS can change the address between validation and connection to reach a blocked internal address. The affected path is the Git clone operation; validation in the migration HTTP client's dialer does not protect the independently connecting Git subprocess.

gitea CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-918

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • gitea

Affected systems

Vendors
gitea
Products
gitea

Deep dive

Full discourse1 post
  • iototsecnews@iototsecnews

    Gitea の 27件の脆弱性が FIX：深刻な SSH 認証バイパスや SSRF の恐れ https://iototsecnews.jp/2026/10/08/gitea-patches-27-security-flaws-including-critical-ssh-authentication-bypass-and-ssrf/ Gitea 製コード管理プラットフォームにおける深刻な欠陥 CVE-2026-103059 について解説する記事です。認証処理の不備や検証機能の欠落に伴い、他者への成りすまし／内部ネットワークへの不正アクセス／承認回避によるプログラム実行といった不具合が生じる危険性があります。対象となる CVE は CVE-2026-103059／CVE-2026-70357／CVE-2026-101027／CVE-2026-101029／CVE-2026-89430／CVE-2026-104632／CVE-2026-94205 です。対象となる製品は Gitea です。対応策として修正版への更新／ネットワークルールの見直しが求められます。 #Gitea #CVE2026103059 #CVE2026103059 #CVE202670357 #CVE2026101027 #CVE2026101029 #CVE202689430 #CVE2026104632 #CVE202694205

    0100089
    518 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appgiteagitea---

Explore more

Back to dashboardgitea CVEsgitea vulnerabilities