CVE-2026-22874: Gitea SSRF Vulnerability

CVE-2026-22874 Overview

CVE-2026-22874 is a Server-Side Request Forgery (SSRF) vulnerability in Gitea, an open-source self-hosted Git service. Gitea versions up to and including 1.26.2 ship with incomplete SSRF protection in the webhook and migration allow-list filtering logic. Authenticated users can craft requests that bypass the URL filter, causing the Gitea server to issue HTTP requests to internal network resources. The flaw is tracked as [CWE-918] and was addressed in Gitea 1.26.3 and 1.26.4.

Critical Impact
An authenticated attacker can pivot from an internet-facing Gitea instance to internal services, cloud metadata endpoints, and other restricted network resources, exposing sensitive infrastructure data.

Affected Products

Gitea versions 1.0.0 through 1.26.2
Gitea webhook subsystem
Gitea repository migration subsystem

Discovery Timeline

2026-07-03 - CVE-2026-22874 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-22874

Vulnerability Analysis

Gitea maintains an allow-list mechanism intended to restrict outbound HTTP requests originating from webhooks and repository migrations. The filter is designed to prevent server-side requests to loopback, link-local, and private network ranges. In releases up to 1.26.2, the filter implementation is incomplete and can be bypassed. An attacker with an account on the Gitea instance can configure a webhook target or initiate a repository migration against a URL that resolves, after processing, to an internal address.

Because the server-side scope changes during exploitation, the vulnerability lets attackers reach resources the Gitea process can access but external users cannot. This includes cloud instance metadata services, internal admin panels, database HTTP interfaces, and Kubernetes API endpoints. Successful exploitation preserves the confidentiality and integrity of retrieved data as observed by the attacker via response reflection or side channels.

Root Cause

The root cause is incomplete input validation in the URL parsing and destination filtering routines used by the webhook and migration handlers. The pre-patch logic did not consistently normalize hostnames, resolve DNS results before enforcement, or account for alternate IP encodings, allowing crafted URLs to bypass the allow-list. Fixes were merged in Gitea pull requests #38059 and #38173.

Attack Vector

Exploitation requires an authenticated account with permission to create a repository, configure a webhook, or trigger a migration. The attacker supplies a URL that evades the allow-list filter but resolves to an internal endpoint. Gitea then dispatches the HTTP request from the server's network context. See the GitHub Security Advisory GHSA-2r5c-gw76-rh3w for advisory details.

Detection Methods for CVE-2026-22874

Indicators of Compromise

Webhook configurations pointing to private RFC1918 addresses, 127.0.0.0/8, 169.254.169.254, or ::1
Repository migration jobs targeting non-public hostnames or IP literals in unusual encodings
Outbound HTTP requests from the Gitea host process to internal services not previously contacted
Unexpected authentication attempts to cloud metadata endpoints originating from the Gitea server

Detection Strategies

Review Gitea audit logs for webhook and migration URLs and correlate against known internal CIDR ranges
Inspect egress traffic from the Gitea host and alert on connections to internal management interfaces
Compare the webhook.ALLOWED_HOST_LIST configuration against actual outbound destinations

Monitoring Recommendations

Forward Gitea application logs and host network flows to a centralized analytics platform such as Singularity Data Lake for correlation across identity and network telemetry
Baseline normal webhook destinations and alert on new internal targets
Monitor for repeated 4xx/5xx responses from internal endpoints that indicate probing behavior

How to Mitigate CVE-2026-22874

Immediate Actions Required

Upgrade Gitea to version 1.26.3 or 1.26.4 as published in the Gitea 1.26.3 and 1.26.4 release announcement
Audit existing webhooks and migration history for URLs targeting internal addresses and remove suspicious entries
Rotate any secrets, tokens, or credentials that may have been exposed via cloud metadata or internal service responses

Patch Information

Gitea released fixed builds tagged v1.26.3 and v1.26.4. The corrective code is merged via pull requests #38059 and #38173, which tighten allow-list enforcement in the webhook and migration paths.

Workarounds

Restrict Gitea account creation and require administrator approval for new users until patching is complete
Enforce strict egress firewall rules that block Gitea's host from reaching internal management networks and cloud metadata addresses
Set webhook.ALLOWED_HOST_LIST to external and disable repository migrations for untrusted users where feasible

bash

# Configuration example: restrict webhook and migration destinations in app.ini
[webhook]
ALLOWED_HOST_LIST = external

[migrations]
ALLOWED_DOMAINS = github.com,gitlab.com
BLOCKED_DOMAINS = 
ALLOW_LOCALNETWORKS = false