{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/gitea--1.26.3/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-25038"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Gitea","Gitea \u003c 1.26.3"],"_cs_severities":["high"],"_cs_tags":["server-side-request-forgery","ssrf","gitea","vulnerability","code-exfiltration","data-exfiltration","information-disclosure","api-vulnerability","web-vulnerability","2fa-bypass","totp","race-condition","authentication-bypass","persistence"],"_cs_type":"advisory","_cs_vendors":["Gitea"],"content_html":"\u003cp\u003eA critical server-side request forgery (SSRF) vulnerability has been identified in Gitea, affecting versions where repository migrations are enabled by default. This flaw enables an authenticated, low-privileged user to bypass Gitea's URL allow/block validation and exfiltrate internal Git repositories. The issue stems from a trust boundary mismatch: Gitea validates the initial public URL provided for repository migration, but the subsequent \u003ccode\u003egit clone\u003c/code\u003e or \u003ccode\u003egit fetch --tags\u003c/code\u003e operation, delegated to the Git command-line client, automatically follows HTTP redirects. Git's default \u003ccode\u003ehttp.followRedirects=initial\u003c/code\u003e setting allows an attacker to provide a public, seemingly benign URL that redirects the Gitea server to an internal Git HTTP(S) endpoint (e.g., \u003ccode\u003ehttp://127.0.0.1:PORT/internal.git/\u003c/code\u003e). This results in the Gitea server cloning internal code, configuration, and potentially sensitive credentials into an attacker-controlled repository. The vulnerability impacts all Gitea instances with repository migrations enabled, posing a significant risk for organizations hosting internal development resources, with persistent data exfiltration possible via pull mirrors continuously updating the attacker's repository.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn authenticated, low-privileged user gains access to a Gitea instance where repository migrations are enabled.\u003c/li\u003e\n\u003cli\u003eThe attacker sets up a public HTTP endpoint (e.g., \u003ccode\u003ehttps://attacker.example/public.git\u003c/code\u003e) controlled by them and configured to issue an HTTP redirect.\u003c/li\u003e\n\u003cli\u003eThe attacker configures this public endpoint to redirect the initial Git discovery request (e.g., \u003ccode\u003eGET /repo.git/info/refs?service=git-upload-pack\u003c/code\u003e) to an internal target, such as \u003ccode\u003ehttp://internal-git.company.local/team/private.git/info/refs\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker initiates a repository migration or mirror creation in Gitea, providing the public \u003ccode\u003ehttps://attacker.example/public.git\u003c/code\u003e URL.\u003c/li\u003e\n\u003cli\u003eGitea's internal validation checks and allows the \u003ccode\u003eattacker.example\u003c/code\u003e host, then invokes \u003ccode\u003egit clone --mirror\u003c/code\u003e or \u003ccode\u003egit fetch --tags\u003c/code\u003e using the provided public URL.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003egit\u003c/code\u003e command-line client follows the HTTP redirect, establishing a network connection to the internal Git repository \u003ccode\u003ehttp://internal-git.company.local/team/private.git\u003c/code\u003e (or \u003ccode\u003e127.0.0.1\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe contents of the internal repository are cloned by the Gitea server into the attacker's newly created repository on the Gitea instance.\u003c/li\u003e\n\u003cli\u003eThe attacker accesses the imported repository, searching for sensitive source code, CI/CD secrets, cloud credentials, Kubernetes kubeconfigs, or production configurations.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe primary impact of this vulnerability is the unauthorized exfiltration of sensitive internal Git repositories, including proprietary source code, configuration files, and critical credentials such as CI variables, cloud access keys, Kubernetes kubeconfigs, deployment SSH keys, and API tokens. For internet-accessible Gitea instances with repository migrations enabled, this poses a high risk of significant data breach. If an attacker leverages pull mirrors, the exfiltration can become persistent, continuously updating the attacker's repository with new internal commits. Although not a direct Remote Code Execution (RCE) in Gitea itself, the stolen credentials can be subsequently used in a post-exploitation chain to gain code execution in CI/CD pipelines, cloud environments, container registries, deployment hosts, or orchestration infrastructure, potentially leading to widespread infrastructure compromise. The vulnerability affects any organization using Gitea to host internal development resources, particularly if valuable intellectual property or sensitive infrastructure secrets are stored within Git repositories.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eDisable repository migration and pull mirrors\u003c/strong\u003e in Gitea if they are not essential for your operational requirements, to mitigate both one-time and persistent exfiltration risks.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eDeploy the provided Sigma rules\u003c/strong\u003e to your SIEM to detect suspicious \u003ccode\u003egit\u003c/code\u003e process network connections to internal IP addresses or private ranges.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eReview Gitea audit logs\u003c/strong\u003e for unusual repository migration attempts originating from external URLs followed by internal network activity.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eImplement strict network segmentation\u003c/strong\u003e and egress filtering for your Gitea server to prevent it from initiating connections to internal development infrastructure or sensitive systems that it should not access.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-21T21:58:24Z","date_published":"2026-07-21T19:20:38Z","id":"https://feed.craftedsignal.io/briefs/2026-07-gitea-repo-exfil-ssrf/","summary":"A critical vulnerability in Gitea allows an authenticated, low-privileged user to exfiltrate internal Git repositories by exploiting a validation bypass, where Gitea's initial URL validation for repository migration is circumvented by the Git command-line client's default behavior of following HTTP redirects to otherwise blocked internal IP addresses, leading to server-side request forgery (SSRF) and the theft of sensitive code, credentials, and configuration into an attacker-controlled repository, with persistent exfiltration possible through pull mirrors.","title":"Gitea Repository Migration SSRF and Internal Git Repository Exfiltration","url":"https://feed.craftedsignal.io/briefs/2026-07-gitea-repo-exfil-ssrf/"}],"language":"en","title":"CraftedSignal Threat Feed - Gitea \u003c 1.26.3","version":"https://jsonfeed.org/version/1.1"}