CVE-2026-96400

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description URL validation during migrations may allow access to reserved and link-local addresses, such as 169.254.169.254, when the [migrations] ALLOWED DOMAINS configuration is set to a wildcard * or a hostname wildcard. This occurs because the local-network block list fails to cover these specific address ranges, and hostnames matching the allow list are accepted regardless of the resolved IP address, bypassing the ALLOW LOCALNETWORKS = false restriction. An attacker with the ability to initiate migrations can use the Gitea server to reach these internal addresses.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid setting [migrations] ALLOWED DOMAINS to * or using hostname wildcards to prevent unauthorized access to reserved and link-local addresses.