Gitea's repository migration and pull mirror egress checks could be bypassed with a hostname that returns multiple DNS answers, because the address that was validated was not necessarily the address Git later connected to. A low-privileged user who can create migrations or mirrors could direct the server to internal services, reading from and writing to reachable internal Git or HTTP endpoints. Content from internal responses could additionally be disclosed through migration and mirror error messages.
References
| Link | Resource |
|---|---|
| https://blog.gitea.com/release-of-28.0.0/ | Release Notes |
| https://github.com/go-gitea/gitea/pull/39010 | Patch Issue Tracking |
| https://github.com/go-gitea/gitea/pull/39426 | Patch Issue Tracking |
| https://github.com/go-gitea/gitea/releases/tag/v28.0.0 | Release Notes |
| https://github.com/go-gitea/gitea/security/advisories/GHSA-6g2h-xpg3-rm48 | Exploit Mitigation Vendor Advisory |
Configurations
History
15 Oct 2026, 02:29
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:* | |
| First Time |
Gitea gitea
Gitea |
|
| References | () https://blog.gitea.com/release-of-28.0.0/ - Release Notes | |
| References | () https://github.com/go-gitea/gitea/pull/39010 - Patch, Issue Tracking | |
| References | () https://github.com/go-gitea/gitea/pull/39426 - Patch, Issue Tracking | |
| References | () https://github.com/go-gitea/gitea/releases/tag/v28.0.0 - Release Notes | |
| References | () https://github.com/go-gitea/gitea/security/advisories/GHSA-6g2h-xpg3-rm48 - Exploit, Mitigation, Vendor Advisory |
07 Oct 2026, 21:17
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.3 |
06 Oct 2026, 20:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-10-06 20:17
Updated : 2026-10-15 02:29
NVD link : CVE-2026-101029
Mitre link : CVE-2026-101029
CVE.ORG link : CVE-2026-101029
JSON object : View
Products Affected
gitea
- gitea