CVE-2026-58418 Overview
CVE-2026-58418 is a Server-Side Request Forgery (SSRF) vulnerability in Gitea, an open-source self-hosted Git service. The flaw resides in the repository migration functionality and allows authenticated attackers to bypass SSRF protections by leveraging HTTP redirects. When Gitea follows redirects during a migration operation, it fails to re-validate the destination URL against the internal network allowlist. This enables attackers to force the Gitea server to issue requests to internal services or cloud metadata endpoints. The issue is tracked under CWE-918 and is addressed in Gitea versions 1.26.3 and 1.26.4.
Critical Impact
Authenticated attackers can coerce the Gitea server into sending HTTP requests to internal network resources, exposing confidential data from services that trust the server's network position.
Affected Products
- Gitea versions prior to 1.26.3
- Gitea repository migration component
- Self-hosted Gitea deployments with migration enabled
Discovery Timeline
- 2026-07-03 - CVE-2026-58418 published to NVD
- 2026-07-06 - Last updated in NVD database
Technical Details for CVE-2026-58418
Vulnerability Analysis
The vulnerability affects Gitea's repository migration workflow, which fetches remote repositories over HTTP or HTTPS. Gitea implements SSRF defenses that block requests to private IP ranges, loopback addresses, and other sensitive destinations. However, these checks apply only to the initial URL supplied by the user. When the remote server returns an HTTP redirect status such as 301 or 302, the client follows the Location header without re-applying the SSRF allowlist. An attacker controlling an external HTTP server can respond with a redirect pointing to internal targets such as http://127.0.0.1:8080 or cloud instance metadata endpoints like http://169.254.169.254/latest/meta-data/.
Root Cause
The root cause is incomplete input validation across redirect chains. The initial destination check does not propagate to subsequent hops resolved by the HTTP client, violating the SSRF mitigation invariant defined in CWE-918. The fix in Gitea Pull Request 38108 enforces validation on every URL the migration client visits, including redirect targets.
Attack Vector
An authenticated Gitea user initiates a repository migration pointing to an attacker-controlled server. The malicious server returns a redirect to an internal address. Gitea follows the redirect and returns the fetched content or observable response behavior to the attacker, disclosing information from services reachable only from the server's network. Exploitation requires valid low-privilege credentials but no user interaction from other parties.
Refer to the GitHub Security Advisory GHSA-rqhx-647v-wx32 for authoritative technical details.
Detection Methods for CVE-2026-58418
Indicators of Compromise
- Outbound HTTP requests from the Gitea server to internal IP ranges shortly after migration API calls to /repo/migrate or /api/v1/repos/migrate.
- Access log entries from the Gitea process targeting cloud metadata endpoints such as 169.254.169.254.
- Migration attempts sourced from newly created or low-reputation user accounts referencing external repository URLs that return redirects.
Detection Strategies
- Correlate Gitea application logs with network flow data to identify migration jobs that produced connections to non-routable or metadata addresses.
- Alert on HTTP 3xx responses received by the Gitea migration client where the Location header resolves to RFC1918 space or link-local addresses.
- Baseline expected migration destinations and flag deviations to unknown external hosts followed by internal connections.
Monitoring Recommendations
- Enable verbose logging of Gitea's outbound HTTP client during migration operations and forward logs to a central SIEM.
- Deploy egress filtering that blocks the Gitea host from reaching internal management interfaces and cloud metadata IPs.
- Monitor authentication events for accounts triggering repeated migration failures, which may indicate SSRF probing.
How to Mitigate CVE-2026-58418
Immediate Actions Required
- Upgrade Gitea to version 1.26.4 or later, or apply the 1.26.3 maintenance release as documented in the Gitea 1.26.3 and 1.26.4 release announcement.
- Restrict the repository migration feature to trusted user roles until patches are deployed.
- Audit recent migration jobs for suspicious external URLs and unexpected redirect chains.
Patch Information
The fix is delivered in Gitea release v1.26.4 via Pull Request 38108. The patch enforces SSRF allowlist checks on every redirect hop within the migration HTTP client. Administrators should validate the deployed binary version with gitea --version after upgrade.
Workarounds
- Disable repository migration in app.ini by setting [repository]DISABLE_MIGRATIONS = true until patches are installed.
- Place the Gitea instance behind an egress proxy that blocks access to private network ranges and cloud metadata endpoints.
- Require administrator approval for user-initiated migrations to reduce exposure from low-privilege accounts.
# Configuration example: disable migrations in app.ini
[repository]
DISABLE_MIGRATIONS = true
# Verify patched version
gitea --version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
