Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
CVE-2026-104626 Overview
CVE-2026-104626 affects Gitea Actions, allowing a fork pull request author to execute attacker-controlled workflow code after a maintainer approval. The attacker places workflow content with a shared run-level concurrency group into an Actions run that is awaiting approval. A later run in that same concurrency group cancels the blocked job, leaving the run in a terminal state while still marked as needing approval. When a maintainer later approves the run, Gitea passes the already-cancelled job back through concurrency preparation, sets it to waiting, and makes it claimable by a matching runner. The result is execution of fork-controlled workflow code under the trust context of an approved run. The issue is categorized under CWE-841: Improper Enforcement of Behavioral Workflow.
Critical Impact
Fork-controlled workflow code can be executed on a self-hosted or shared runner after maintainer approval, breaking the approval boundary Gitea Actions enforces for untrusted contributors.
Affected Products
- Gitea versions prior to v28.0.0
- Gitea Actions with fork pull request workflows enabled
- Deployments using runners that accept the affected repository's jobs
Discovery Timeline
- 2026-10-06 - CVE-2026-104626 published to NVD
- 2026-10-07 - Last updated in NVD database
- Patched in - Gitea Release v28.0.0 via Pull Request #39399 and GitHub Security Advisory GHSA-93pj-3x56-5gc2
Technical Details for CVE-2026-104626
Vulnerability Analysis
Gitea Actions requires maintainer approval before running workflows from fork pull requests. This approval boundary blocks untrusted code from reaching a runner. The vulnerability breaks that boundary through a race between concurrency handling and approval state. An attacker opens a fork pull request that defines a workflow with a run-level concurrency group shared with other runs. The run enters the awaiting-approval state. A subsequent run in the same concurrency group cancels the blocked job. The run becomes terminal, yet retains the needs-approval marker. When a maintainer later clicks approve, Gitea re-enters the cancelled job into concurrency preparation. The job transitions to waiting and becomes claimable by any runner that accepts jobs for the repository. The runner then executes the fork-authored workflow steps.
Root Cause
The root cause is improper enforcement of workflow state transitions [CWE-841]. The approval path does not validate that a job already reached a terminal cancelled state before re-queuing it. Concurrency preparation treats the stale job as a candidate for execution rather than rejecting it.
Attack Vector
Exploitation requires three conditions. First, Actions must be enabled on the target repository. Second, a runner must accept jobs for that repository. Third, a maintainer must perform the approval action after the attacker-staged cancellation. The attacker needs only the ability to open a fork pull request. See the GitHub Security Advisory GHSA-93pj-3x56-5gc2 for the full exploitation sequence.
Detection Methods for CVE-2026-104626
Indicators of Compromise
- Actions runs that transition from a cancelled or terminal state back to waiting after a maintainer approval event
- Workflow definitions in fork pull requests that declare a run-level concurrency group matching the base repository's own workflow runs
- Runner job claims for workflows whose source commit is from an unmerged fork pull request
Detection Strategies
- Audit Gitea Actions database tables for jobs where the status column changed from cancelled to waiting without an intervening re-run action
- Review repository audit logs for approval events closely preceded by concurrency-driven cancellations on the same run
- Correlate runner execution logs with pull request source information to identify workflow executions sourced from fork refs
Monitoring Recommendations
- Forward Gitea application logs and runner logs to a centralized logging platform for continuous review
- Alert on approval actions that result in runner job assignment for workflows originating from fork pull requests
- Track runner process activity for unexpected outbound network connections, credential access, or filesystem changes during fork-sourced jobs
How to Mitigate CVE-2026-104626
Immediate Actions Required
- Upgrade Gitea to v28.0.0 or later, which contains the fix from Pull Request #39399
- Review recent fork pull request approvals and inspect runner job history for suspicious workflow executions
- Rotate any secrets, tokens, or credentials exposed to self-hosted runners that executed fork-sourced jobs
Patch Information
The fix ships in Gitea v28.0.0. Details are documented in the Gitea 28.0.0 release announcement and the GitHub Security Advisory GHSA-93pj-3x56-5gc2. The patch ensures jobs that reached a terminal cancelled state are not re-queued through concurrency preparation when a later approval occurs.
Workarounds
- Disable Gitea Actions on repositories that accept fork pull requests until the upgrade is applied
- Restrict runners to trusted repositories only, preventing shared runners from claiming jobs sourced from fork pull requests
- Require manual review of workflow YAML changes in fork pull requests before granting approval, with specific attention to concurrency declarations
# Disable Actions globally in app.ini until patched
[actions]
ENABLED = false
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
