CVE-2026-58314

CVE-2026-58314 documents two SSRF findings in Gitea 1.26.2 via (1) webhook/migrations HTTP flows and (2) OpenID sign‑in discovery. Technical details show the root cause: hostmatcher’s external check permits many non‑public/transition prefixes (CGNAT, NAT64, Teredo, etc.), enabling server‑side req...