CVE-2026-33353
Soft Serve: Authenticated repo import can clone server-local private repositories
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
2th
Soft Serve is a self-hostable Git server for the command line. From version 0.6.0 to before version 0.11.6, an authorization flaw in repo import allows any authenticated SSH user to clone a server-local Git repository, including another user's private repo, into a new repository they control. This issue has been patched in version 0.11.6.
| CWE | CWE-200 CWE-862 |
| Vendor | charmbracelet |
| Product | soft-serve |
| Published | Mar 24, 2026 |
| Last Updated | Mar 25, 2026 |
Stay Ahead of the Next One
Get instant alerts for charmbracelet soft-serve
Be the first to know when new unknown vulnerabilities affecting charmbracelet soft-serve are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
charmbracelet / soft-serve
>= 0.6.0, < 0.11.6