CVE-2026-58441 SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL
Attackers can exploit unsanitized CloneURL in pull_request.yml to perform Server-Side Request Forgery against internal services.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-58441?
CVE-2026-58441 is a medium-severity server-side request forgery vulnerability in Gitea Open Source Git Server, published on 13 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL
Weakness: CWE-918
Which versions are affected by CVE-2026-58441?
3 open source packages ship an affected version, including code.gitea.io/gitea and gitea.dev.
| Package | Affected | Fixed in |
|---|---|---|
code.gitea.io/gitea Go | All versions | 1.27.0 |
code.gitea.io/gitea Go | All versions | 1.27.0 |
gitea.dev Go | All versions | 1.27.0 |
How do I fix CVE-2026-58441?
Upgrade code.gitea.io/gitea to 1.27.0 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-58441 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-58441 exists.
Sources
Also known as GHSA-xmj7-xj85-hfc3, GO-2026-6084, MINI-gqj5-49fh-f333, MINI-hx2h-2xwm-2423.