https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T01:44:40.247714+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-09234 bdu:2026-09234 2026-10-04T01:44:40.326519+00:00 bdu:2026-09234 https://cve.radiocsirt.org/vuln/euvd-2026-333756 EUVD-2026-333756 2026-10-04T01:44:40.326565+00:00 EUVD-2026-333756 https://cve.radiocsirt.org/vuln/fkie_cve-2026-22874 fkie_cve-2026-22874 2026-10-04T01:44:40.326590+00:00

Gitea versions up to and including 1.26.2 have incomplete SSRF protection in webhook and migration allow-list filtering.

 https://cve.radiocsirt.org/vuln/ghsa-2r5c-gw76-rh3w GHSA-2r5c-gw76-rh3w — Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter 2026-10-04T01:44:40.326631+00:00

Affected: Go: code.gitea.io/gitea

## Summary

Gitea's default SSRF allow-list ([`MatchBuiltinExternal`](https://github.com/go-gitea/gitea/blob/4c37f4dacbac022f7beca75272439331f0368830/modules/hostmatcher/hostmatcher.go#L26-L27), used by both webhook delivery and repository migrations) relies on Go's standard library [`net.IP.IsPrivate()`](https://pkg.go.dev/net#IP.IsPrivate), which only covers RFC 1918 and RFC 4193. As a result, several IP ranges commonly used for cloud metadata services, internal networks, and IPv6 transition mechanisms are not blocked, allowing authenticated users to send HTTP requests to those destinations and read the responses via the webhook history UI.

## Details

The vulnerability lives in [`HostMatchList.checkIP`](https://github.com/go-gitea/gitea/blob/4c37f4dacbac022f7beca75272439331f0368830/modules/hostmatcher/hostmatcher.go#L96-L114), specifically [line 103](https://github.com/go-gitea/gitea/blob/4c37f4dacbac022f7beca75272439331f0368830/modules/hostmatcher/hostmatcher.go#L103):

```go case MatchBuiltinExternal: if ip.IsGlobalUnicast() && !ip.IsPrivate() { return true } ```

`net.IP.IsPrivate()` recognises only: - `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16` (RFC 1918) - `fc00::/7` (RFC 4193 IPv6 ULA)

It does **not** recognise:

| Range | Description | |---|---| | `100.64.0.0/10` | RFC 6598 Carrier-Grade NAT | | `168.63.129.16/32` | Azure WireServer metadata endpoint | | `172.32.0.0/11` | Non-RFC1918 portion of `172.0.0.0/8` (real-world internal use) | | `64:f…

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2027 WID-SEC-W-2026-2027 — Gitea: Mehrere Schwachstellen 2026-10-04T01:44:40.326766+00:00

Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um erweiterte Berechtigungen zu erlangen, sich als Benutzer auszugeben, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und vertrauliche Informationen offenzulegen.