CVE-2026-54481

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description The internal API HTTP client in modules/private/internal.go hardcodes TLSClientConfig.InsecureSkipVerify = true, which disables TLS certificate verification for outbound internal requests. When the LOCAL ROOT URL is configured to use HTTPS on a non-loopback target (such as in split-host or multi-pod topologies), the client accepts any TLS certificate, including self-signed ones.

An attacker with an on-path position on the internal network segment can perform a man-in-the-middle (MITM) attack to intercept the connection and capture the static high-privilege INTERNAL TOKEN sent in the X-Gitea-Internal-Auth header. This token is the sole authentication mechanism for all /api/internal/* endpoints. A captured token allows an attacker to perform administrative actions, including shutting down or restarting the server, authorizing SSH keys, executing git commands, controlling repository hooks, sending emails, and generating Actions runner tokens.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.