CVE-2026-96400
Gitea migration SSRF to reserved addresses through ALLOWED_DOMAINS
- State
- Published
- Severity
- 4.3 Medium
- Published
- Oct 6, 2026
- Updated
- Oct 7, 2026
- Reserved
- Oct 4, 2026
Description
With `[migrations] ALLOWED_DOMAINS` set to a matching entry such as `*` or a hostname wildcard, Gitea's migration URL validation could permit reserved and link-local addresses, such as `169.254.169.254`, even when `ALLOW_LOCALNETWORKS = false`. The local-network block list did not cover these ranges, and a hostname matching the allow list was accepted regardless of its resolved address. A user who can start migrations on such an instance could reach these addresses from the Gitea server; the default empty `ALLOWED_DOMAINS` configuration is not affected.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | CISA-ADP |
Weaknesses
- CWE-918 Server-Side Request Forgery (SSRF)
Affected Products
| Product | Versions |
|---|---|
GiteaGitea |
|
References
- GitHub Security Advisory GHSA-54w9-6cc5-9wj9vendor-advisory
- Fix: go-gitea/gitea pull request #39426patch
- Gitea 28.0.0 release announcementrelease-notes
- go-gitea/gitea v28.0.0 releaserelease-notes
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.