CVE-2026-89430 Gitea push mirror SSRF and forced writes to internal Git hosts

Gitea validated a push mirror's remote address against the migrations allow and block lists only when the mirror was created. Each synchronization passed the stored address directly to git push, so a name that later resolved to a blocked or internal address was still reached. A user with...

CVE-2026-89430

The Gitea platform is vulnerable to a Server-Side Request Forgery (SSRF) and forced write vulnerability due to insufficient validation of push mirror remote addresses. The system only validates these addresses against [migrations] allow and block lists during the initial mirror creation. Because ...

CVE-2026-103670

The Gitea actions system is vulnerable to unauthorized workflow cancellation. When a new actions run is inserted into a concurrency group with cancel-in-progress enabled, the system cancels older runs without verifying if the new run requires approval. Because fork pull request runs are inserted ...

CVE-2026-103667

The Gitea container registry is vulnerable to a stored XSS flaw because it serves blob downloads using a Content-Type derived directly from the media type in pushed image manifests. Due to the lack of a Content-Disposition header or a restrictive content security policy, an attacker with push pri...

CVE-2026-101029 Gitea migration and pull mirror SSRF through multi-answer DNS

Gitea's repository migration and pull mirror egress checks could be bypassed with a hostname that returns multiple DNS answers, because the address that was validated was not necessarily the address Git later connected to. A low-privileged user who can create migrations or mirrors could direct th...

CVE-2026-101029

The Gitea repository migration and pull mirror features are vulnerable to a Server-Side Request Forgery (SSRF) due to a Time-of-check Time-of-use (TOCTOU) race condition. The egress checks can be bypassed by using a hostname that returns multiple DNS answers , as the address validated by the syst...

CVE-2026-101027 Gitea migration SSRF through ALLOWED_DOMAINS address check bypass

When migrations ALLOWEDDOMAINS was configured, a hostname matching the allow list was accepted without checking its resolved address against the local-network restrictions. A user who can start repository migrations and control the DNS of an allowed hostname could make it resolve to loopback or...

CVE-2026-101027

The Gitea server is vulnerable to a Server-Side Request Forgery (SSRF) due to an address check bypass in the migration functionality. When [migrations] ALLOWED_DOMAINS is configured, the system accepts hostnames from the allow list without verifying their resolved addresses against local-network ...

CVE-2026-104626

The Gitea Actions system is vulnerable to a workflow job revival flaw. A user capable of opening a fork pull request can inject workflow content using a shared run-level concurrency group into a run awaiting approval. If a subsequent run in that group cancels the blocked job, the run enters a ter...

CVE-2026-104626 Gitea fork workflow job revival through later approval

A user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a Gitea Actions run that is awaiting approval. When a later run in that group cancels the blocked job, the run becomes terminal while still marked as needing approval. If a maintainer...

CVE-2026-103059

A flaw in Gitea allows an authentication bypass when the built-in SSH server is enabled (START_SSH_SERVER = true). The root cause is the use of an SQL LIKE comparison for looking up public keys, which is case-insensitive on certain databases like SQLite . An attacker who can construct a case vari...

CVE-2026-103059 Gitea built-in SSH server authentication bypass through key case folding

When Gitea's built-in SSH server is enabled STARTSSHSERVER = true, the presented public key was looked up with an SQL LIKE comparison of its encoded content, which is case-insensitive on some databases, including the default SQLite. An attacker who can construct a case variant of another user's...

CVE-2026-104632 Gitea fork workflow approval bypass through cancel and rerun

Gitea Actions blocks the jobs of workflow runs from first-time fork pull request contributors until a maintainer approves the run. The rerun path only required a run to be finished and built the new attempt's jobs without considering the pending approval, so when a user with Actions write access...

CVE-2026-104632

Gitea Actions contains a vulnerability where workflow jobs from first-time fork pull request contributors can bypass the required maintainer approval. The root cause is that the rerun path only checks if a run is finished and builds new jobs without verifying the pending approval status. An attac...

CVE-2026-79818

A vulnerability exists in the API interface of ClearPass Policy Manager that allows an unauthenticated remote attacker to bypass existing authentication controls. Successful exploitation of this flaw could result in unauthorized information disclosure from the affected system. No specific patch v...

CVE-2026-79817

A sensitive information disclosure vulnerability exists in the client software of HPE Networking ClearPass Policy Manager . An attacker with local access to the affected system could exploit this flaw to obtain sensitive information. The vulnerability is assigned a CVSS 3.1 score of 5.5 (Medium) ...

CVE-2026-79815

The ClearPass Policy Manager OnGuard agent is susceptible to a command injection vulnerability. An authenticated remote attacker can exploit this flaw to inject arbitrary commands, potentially resulting in the execution of commands with elevated privileges on the affected Windows endpoint . No sp...

CVE-2026-79816

A DOM-based cross-site scripting (XSS) vulnerability exists in the client interface of HPE Networking ClearPass Policy Manager . This flaw allows an unauthenticated remote attacker to execute arbitrary script code within a victim's browser context while using the affected client interface. No spe...

CVE-2026-79814

The ClearPass Policy Manager OnGuard agent contains an arbitrary file write vulnerability. This flaw could enable a local attacker to achieve local privilege escalation by executing arbitrary code with elevated privileges, provided specific preconditions outside the attacker's control are met. Th...

CVE-2026-79813

A local privilege escalation vulnerability exists in the ClearPass client software . This flaw could allow a low-privileged local user to execute commands with elevated privileges on the affected system, provided specific conditions outside the attacker's control are met. No specific software ver...