CVE-2026-101027

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description A flaw exists when the [migrations] ALLOWED DOMAINS configuration is active. The system accepts hostnames matching the allow list without verifying if the resolved address violates local-network restrictions. An attacker capable of initiating repository migrations and controlling the DNS of an allowed hostname can force it to resolve to loopback or private addresses. This allows the bypass of the ALLOW LOCALNETWORKS = false setting, enabling the Gitea server to reach internal services.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.