CVE-2026-34966 Gitea prior to 1.27.0 SSRF via Migration URI Fetch Bypass
Authenticated attackers can bypass SSRF protections in Gitea to access internal services and read sensitive configuration files via migration or OAuth endpoints.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-34966?
CVE-2026-34966 is a high-severity server-side request forgery vulnerability in Gitea, published on 5 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply arbitrary URLs through release asset download URLs, pull-request patch URLs, or OAuth avatar endpoints to reach internal services, cloud instance-metadata endpoints, or read local files such as the application configuration containing database credentials and signing secrets, with exfiltrated content persisted as migration release assets for later retrieval.
Weakness: CWE-918
Which versions are affected by CVE-2026-34966?
How do I fix CVE-2026-34966?
Upgrade to a fixed version.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-34966 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-34966 exists.
Sources
Also known as GHSA-685p-fm6j-c445, MINI-42x7-c53m-9pfg, MINI-75gh-p2gp-m7jf.