CVE-2026-59765 SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata
Attackers can exploit SSRF in migration asset downloads to bypass host restrictions and read internal files or cloud metadata.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-59765?
CVE-2026-59765 is a high-severity server-side request forgery vulnerability in Gitea Open Source Git Server, published on 13 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata
Weakness: CWE-918
Which versions are affected by CVE-2026-59765?
How do I fix CVE-2026-59765?
Apply the vendor's patch.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-59765 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-59765 exists.
Sources
Also known as MINI-5w87-3hqw-jp29, MINI-hg8w-v68h-wq7j.