CVE-2026-96400 Gitea migration SSRF to reserved addresses through ALLOWED_DOMAINS
Attackers can exploit Gitea's migration feature to access reserved internal addresses if ALLOWED_DOMAINS is configured broadly, bypassing local network restrictions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-96400?
CVE-2026-96400 is a medium-severity server-side request forgery vulnerability in Gitea Gitea, published on 6 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
With `[migrations] ALLOWED_DOMAINS` set to a matching entry such as `*` or a hostname wildcard, Gitea's migration URL validation could permit reserved and link-local addresses, such as `169.254.169.254`, even when `ALLOW_LOCALNETWORKS = false`. The local-network block list did not cover these ranges, and a hostname matching the allow list was accepted regardless of its resolved address. A user who can start migrations on such an instance could reach these addresses from the Gitea server; the default empty `ALLOWED_DOMAINS` configuration is not affected.
Weakness: CWE-918
Which versions are affected by CVE-2026-96400?
1 open source package ship an affected version, including gitea. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
gitea Bitnami | All versions | 28.0.0 |
Products include Gitea Gitea.
How do I fix CVE-2026-96400?
Upgrade gitea to 28.0.0 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-96400 being exploited?
There is no known exploitation of CVE-2026-96400 in the wild and no public exploit code.
Other vulnerabilities in Gitea Gitea
Sources
Also known as BIT-gitea-2026-96400, GHSA-54w9-6cc5-9wj9, MINI-h9p4-gr64-5rq4, MINI-p79h-f3gr-4f5r.