CVE-2026-58423

Summary

LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories

Affected Software

Weaknesses

• CWE-287: CWE-287

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: partial

Additional References

• https://github.com/go-gitea/gitea/security/advisories/GHSA-7wvc-rvp7-w99x

References

• https://github.com/go-gitea/gitea/security/advisories/GHSA-7wvc-rvp7-w99x
• https://github.com/go-gitea/gitea/pull/38008
• https://github.com/go-gitea/gitea/releases/tag/v1.26.4
• https://blog.gitea.com/release-of-1.26.3-and-1.26.4/

• ←Previous
• Next→