CVE-2026-101029

UNKNOWN 0.0

Gitea migration and pull mirror SSRF through multi-answer DNS

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Gitea's repository migration and pull mirror egress checks could be bypassed with a hostname that returns multiple DNS answers, because the address that was validated was not necessarily the address Git later connected to. A low-privileged user who can create migrations or mirrors could direct the server to internal services, reading from and writing to reachable internal Git or HTTP endpoints. Content from internal responses could additionally be disclosed through migration and mirror error messages.

CWE	CWE-209 CWE-367 CWE-918
Vendor	gitea
Product	gitea
Published	Oct 6, 2026

Stay Ahead of the Next One

Get instant alerts for gitea gitea

Be the first to know when new unknown vulnerabilities affecting gitea gitea are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Gitea / Gitea

0 ≤ 1.27.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/go-gitea/gitea/security/advisories/GHSA-6g2h-xpg3-rm48 github.com: https://github.com/go-gitea/gitea/pull/39010 github.com: https://github.com/go-gitea/gitea/pull/39426 blog.gitea.com: https://blog.gitea.com/release-of-28.0.0/ github.com: https://github.com/go-gitea/gitea/releases/tag/v28.0.0

Credits

🔍 https://github.com/cipher-creator https://github.com/TheFox0x7 https://github.com/silverwind https://github.com/bircni https://github.com/wxiaoguang