Tag

Lfs

1 brief RSS

Gitea LFS Authentication Bypass via Malformed SSH Sub-Verb

A high-severity authentication bypass vulnerability (CVE-2026-58423) in Gitea's SSH Git LFS handling allows any authenticated SSH user to obtain valid LFS credentials for any private repository, enabling unauthorized download of all LFS objects from instances running Gitea versions 1.23.0 through 1.26.2.

Gitea lfs ssh authentication-bypass information-disclosure vulnerability

1r 4t 1c 2h ago