Critical · 9.1 CVE-2026-58508 EUVD-2026-58174

Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)

Published Aug 13, 2026 · Updated Aug 14, 2026 · Assigned by Gitea

Vendor: Gitea Product: Gitea Open Source Git Server

Description

Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)

Affected products

Vendor	Product	Affected	Fixed
Gitea	Gitea Open Source Git Server	≤ 1.26.4	—

Advisories 1

WID-SEC-2026-2304 Gitea: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 14, 2026

References

GitHub Security Advisory vendor-advisory
Gitea v1.27.0 Release release-notes
Gitea v1.27.0 Release Blog Post release-notes