CVE-2026-58442

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description An authenticated low-privilege user can perform a server-side request forgery (SSRF) during repository migration. The issue occurs because the validation logic in services/migrations/migrate.go accepts a destination if any resolved IP address is allowed, even if other resolved IPs are blocked or loopback addresses. An attacker can use a DNS name that resolves to both a public allowed IP and a blocked internal IP to bypass these filters. Since the subsequent git clone operation performs its own DNS resolution, it may connect to the internal address, allowing the attacker to import contents from internal-only Git services or private network resources into a repository they control.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

As a temporary mitigation, restrict the use of the repository migration feature or ensure that the ALLOW LOCALNETWORKS setting is strictly managed to minimize the risk of internal network exposure.