CVE-2026-34966: Gitea SSRF Vulnerability

CVE-2026-34966 Overview

CVE-2026-34966 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in Gitea versions prior to 1.27.0. Authenticated attackers can bypass Gitea's SSRF protections by abusing HTTP fetch operations in migration and OAuth avatar code paths. These paths use Go's default http.Get without a custom DialContext, so the built-in URL allowlisting does not apply. Attackers supply arbitrary URLs through release asset download URLs, pull-request patch URLs, or OAuth avatar endpoints. The server then fetches internal services, cloud instance-metadata endpoints, or local files, and the response content is persisted as migration release assets for later retrieval.

Critical Impact
Authenticated attackers can read local files including app.ini containing database credentials and signing secrets, and reach internal network services and cloud metadata endpoints.

Affected Products

Gitea self-hosted Git service versions prior to 1.27.0
Gitea instances exposing migration functionality to authenticated users
Gitea deployments using OAuth providers that fetch remote avatars

Discovery Timeline

2026-08-05 - CVE-2026-34966 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-34966

Vulnerability Analysis

Gitea enforces SSRF protections through a custom DialContext that rejects requests to internal addresses, loopback, and link-local ranges. Several HTTP fetch code paths bypass this control by calling Go's standard http.Get directly instead of the hardened HTTP client. These paths include release asset download URLs, pull-request patch URLs used during repository migration, and the OAuth avatar fetch routine. An authenticated attacker submits a crafted migration source or OAuth avatar URL pointing at an internal target. The server-side worker fetches the resource and stores the response as a migration release asset. The attacker retrieves the asset through normal Gitea UI or API access, completing exfiltration.

Root Cause

The root cause is inconsistent use of the hardened HTTP client across Gitea's migration and avatar subsystems. The affected call sites instantiate the default http.Client and invoke http.Get without wiring the custom DialContext that enforces address allowlisting. This defeats the SSRF allowlist and permits URLs with schemes such as file://, http://127.0.0.1, and http://169.254.169.254.

Attack Vector

An authenticated user initiates a repository migration and supplies a malicious URL as the source or as a release asset URL. Alternative vectors include triggering an OAuth login flow with an attacker-controlled avatar URL, or submitting a crafted pull-request patch URL. The attacker specifies targets such as file:///etc/gitea/app.ini to read configuration secrets, http://169.254.169.254/latest/meta-data/iam/security-credentials/ to steal cloud instance-metadata credentials, or internal HTTP services normally unreachable from the internet. Fetched content is persisted as a migration release asset that the attacker then downloads.

The upstream fix is delivered in commit b969123b7fac51c88daab5cb64e5b2f4abd53288. See the Gitea Security Advisory GHSA-2wm4-vwp6-v7xc and the VulnCheck Gitea SSRF Advisory for technical details.

Detection Methods for CVE-2026-34966

Indicators of Compromise

Migration jobs whose source URL points at RFC1918, loopback, or link-local addresses such as 127.0.0.1, 10.0.0.0/8, or 169.254.169.254.
Release assets on migrated repositories containing plaintext configuration data, private keys, or cloud IAM credential JSON.
OAuth account records with avatar URLs referencing internal hostnames or the file:// scheme.
Outbound HTTP requests from the Gitea process to cloud metadata endpoints not previously observed.

Detection Strategies

Inspect Gitea application logs for migration and avatar fetch events referencing non-public URLs or unusual URI schemes.
Correlate process-level network telemetry from the Gitea host with expected external Git provider destinations, and alert on deviations.
Review the release_asset table for files whose sizes or names are inconsistent with legitimate migrated release binaries.

Monitoring Recommendations

Forward Gitea audit and application logs to a centralized logging platform and alert on migration source URLs failing egress policy.
Monitor host-level connections from the Gitea service account to 169.254.169.254, localhost ports, and internal RFC1918 targets.
Track creation of new release assets by users who initiated repository migrations in the preceding minutes.

How to Mitigate CVE-2026-34966

Immediate Actions Required

Upgrade all Gitea instances to version 1.27.0 or later, which routes migration and OAuth avatar fetches through the hardened HTTP client.
Rotate database credentials, JWT signing secrets, OAuth client secrets, and any cloud IAM credentials reachable from the Gitea host, as they must be considered compromised.
Audit existing release assets created by migration jobs for exfiltrated configuration or credential material and remove them.

Patch Information

The fix is included in Gitea 1.27.0 and applied in upstream commit b969123b7fac51c88daab5cb64e5b2f4abd53288. The patch replaces direct http.Get calls in the affected paths with the SSRF-aware HTTP client that enforces the address allowlist via a custom DialContext. Refer to the Gitea repository for backport availability.

Workarounds

Restrict Gitea's egress network access with a firewall or egress proxy that blocks connections to loopback, RFC1918 ranges, and cloud metadata endpoints such as 169.254.169.254.
Disable the repository migration feature for untrusted users by adjusting [repository] and [service] sections in app.ini until the upgrade is applied.
Disable OAuth providers that fetch remote avatars, or configure the OAuth source to use a static avatar until patched.

bash

# app.ini hardening: restrict migrations and disable remote avatar fetches
[migrations]
ALLOWED_DOMAINS = github.com,gitlab.com
BLOCKED_DOMAINS = 
ALLOW_LOCALNETWORKS = false

[picture]
DISABLE_GRAVATAR = true
ENABLE_FEDERATED_AVATAR = false

[service]
DISABLE_MIGRATIONS = true