CVE-2026-109553

UNKNOWN 0.0

Gitea SSH certificate principal impersonation of other users

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. When Gitea trusts a user certificate authority (`SSH_TRUSTED_USER_CA_KEYS`) and accepts arbitrary principals (`SSH_AUTHORIZED_PRINCIPALS_ALLOW=anything`), a user could register another user's public key line as their own principal, or a holder of a certificate signed by that authority could list it, and then authenticate as the owner of that key through the HTTP signature API and the built-in SSH server. Instances that do not trust a user certificate authority are not affected.

Vendor	gitea
Product	gitea
Published	Oct 18, 2026

Stay Ahead of the Next One

Get instant alerts for gitea gitea

Be the first to know when new unknown vulnerabilities affecting gitea gitea are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Gitea / Gitea

0 ≤ 28.1.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/go-gitea/gitea/security/advisories/GHSA-vcp6-2qc6-gvq3 github.com: https://github.com/go-gitea/gitea/pull/39839 github.com: https://github.com/go-gitea/gitea/pull/39847 blog.gitea.com: https://blog.gitea.com/release-of-28.2.0/ github.com: https://github.com/go-gitea/gitea/releases/tag/v28.2.0

Credits

🔍 https://github.com/DshtAnger https://github.com/silverwind https://github.com/wxiaoguang https://github.com/bircni