CVE-2026-58423: LFS Authentication Bypass Vulnerability

CVE-2026-58423 Overview

CVE-2026-58423 is an authentication bypass vulnerability in Gitea that allows unauthorized read access to private repositories through the Git Large File Storage (LFS) subsystem. An authenticated attacker can send a malformed Secure Shell (SSH) sub-verb that bypasses repository access checks. The flaw is tracked under CWE-287: Improper Authentication and is fixed in Gitea version 1.26.4. The bypass exposes source code, commit history, and any binary assets stored via LFS in repositories the attacker should not access.

Critical Impact
Authenticated users can read private repository content over SSH by crafting a malformed LFS sub-verb, exposing proprietary source code and secrets stored in private Gitea repositories.

Affected Products

Gitea versions prior to 1.26.3
Gitea 1.26.3 (partial fix; superseded by 1.26.4)
Self-hosted Gitea instances with SSH and LFS enabled

Discovery Timeline

2026-07-03 - CVE-2026-58423 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-58423

Vulnerability Analysis

The vulnerability resides in Gitea's SSH command dispatcher, which routes authenticated SSH sessions to specific Git operations including git-upload-pack, git-receive-pack, and git-lfs-authenticate. The LFS authentication path parses an SSH sub-verb argument to determine the requested operation and target repository. Malformed input to this sub-verb causes the authorization check to be skipped or misapplied, while the underlying LFS token issuance still proceeds.

Once the attacker obtains a valid LFS access token for a repository they do not own, they can retrieve LFS object contents and repository metadata over HTTPS. The impact is confined to confidentiality — the attacker gains read access but cannot modify repository state, matching the impact profile described in the GitHub Security Advisory GHSA-7wvc-rvp7-w99x.

Root Cause

The root cause is improper authentication [CWE-287] in the SSH command parser. Gitea's git-lfs-authenticate handler failed to validate the structure of the sub-verb before granting an LFS token. When the sub-verb was malformed, the code path that enforces repository read permissions was bypassed, but token issuance continued using attacker-controlled repository identifiers.

Attack Vector

Exploitation requires a valid Gitea account with SSH key access — any low-privilege authenticated user qualifies. The attacker connects over SSH and issues a git-lfs-authenticate command with a malformed sub-verb targeting an arbitrary private repository path. Gitea returns an LFS token and endpoint URL. The attacker then uses standard Git LFS clients to enumerate and download objects from the private repository. No user interaction and no elevated privileges are required. Full technical details are available in Gitea Pull Request #38008.

Detection Methods for CVE-2026-58423

Indicators of Compromise

SSH sessions invoking git-lfs-authenticate against repositories the authenticated user has no membership or collaborator record for
Malformed or unexpected argument patterns following the git-lfs-authenticate verb in SSH command logs
LFS token issuance events immediately followed by object downloads from IP addresses or accounts inconsistent with the repository's contributor set
Spikes in LFS API GET requests for objects/ endpoints across multiple unrelated repositories from a single account

Detection Strategies

Parse Gitea SSH logs for git-lfs-authenticate invocations and correlate the target repository against the caller's permission set
Alert on any git-lfs-authenticate command whose argument string does not match the expected owner/repo verb grammar
Baseline each user's normal repository access pattern and flag first-time LFS access to repositories outside that baseline

Monitoring Recommendations

Enable verbose SSH command logging in Gitea and forward logs to a centralized analytics platform for retention and query
Monitor the Gitea router and serv log channels for authentication decisions on LFS endpoints
Track LFS bandwidth consumption per user and alert on outliers relative to historical usage

How to Mitigate CVE-2026-58423

Immediate Actions Required

Upgrade Gitea to version 1.26.4 or later without delay, following the Gitea 1.26.4 release notes
Audit SSH command logs since the vulnerable version was deployed to identify any suspicious git-lfs-authenticate invocations
Rotate any secrets, tokens, or credentials stored in private repositories that may have been accessed
Review repository access logs and LFS object download history for anomalous cross-repository access

Patch Information

Gitea released version 1.26.4 containing the fix. The corresponding code change is available in Gitea Pull Request #38008 and documented in the Gitea release announcement for 1.26.3 and 1.26.4. Administrators running self-hosted Gitea instances should apply the update immediately.

Workarounds

Disable Git LFS in the Gitea configuration until the patch can be applied by setting [lfs] ENABLED = false in app.ini
Restrict SSH access to Gitea to a smaller trusted user population using network controls or SSH certificate authorities
Require multi-factor authentication for all Gitea accounts to raise the cost of credential compromise that precedes exploitation

bash

# Configuration example - disable LFS as a temporary workaround in app.ini
[lfs]
ENABLED = false

# After upgrading to 1.26.4, re-enable LFS
[lfs]
ENABLED = true
PATH = /var/lib/gitea/data/lfs