Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Medium severity, with a CVSS score of 5.3, published 30 October 2026.

Which products and versions are affected?

Charmbracelet Soft-Serve v0.5.0 through v0.12.2; github.com/charmbracelet/soft-serve (Go) >= 0.5.0, < 0.12.3, SEMVER:introduced=0.5.0,fixed=0.12.3.

How is This vulnerability attacked?

It is attacked over the network, in a hosted service.

Check whether you run Charmbracelet Soft-Serve or github.com/charmbracelet/soft-serve (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

charmbracelet soft-serve repository name disclosure via HTTP

Q: Is there a fix for This vulnerability?

Yes. github.com/charmbracelet/soft-serve (Go): upgrade to 0.12.3 or later. Until then: Disable the HTTP server entirely with `http.enabled: false` to remove HTTP-based exposure, or restrict anonymous access by setting `anon-access: no-access` to limit disclosure to authenticated users only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected?

Check whether you run Charmbracelet Soft-Serve or github.com/charmbracelet/soft-serve (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: medium · CVSS 5.3 · Published 2026-10-30

Soft Serve is a Git repository server. A remote attacker can discover the existence and names of private repositories by making ordinary HTTP requests, learning sensitive project names and clone URLs that may be internal codenames or customer names. No account or special access is required under default configuration.

Technologies: Charmbracelet Soft-Serve, github.com/charmbracelet/soft-serve (Go). Vendors: Charmbracelet, Go.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Medium severity, with a CVSS score of 5.3, published 30 October 2026.
Which products and versions are affected?: Charmbracelet Soft-Serve v0.5.0 through v0.12.2; github.com/charmbracelet/soft-serve (Go) >= 0.5.0, < 0.12.3, SEMVER:introduced=0.5.0,fixed=0.12.3.
Is there a fix for This vulnerability?: Yes. github.com/charmbracelet/soft-serve (Go): upgrade to 0.12.3 or later. Until then: Disable the HTTP server entirely with `http.enabled: false` to remove HTTP-based exposure, or restrict anonymous access by setting `anon-access: no-access` to limit disclosure to authenticated users only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a hosted service.
Am I affected?: Check whether you run Charmbracelet Soft-Serve or github.com/charmbracelet/soft-serve (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/charmbracelet/soft-serve (Go): upgrade to 0.12.3 or later
```
go get github.com/charmbracelet/soft-serve@v0.12.3
```

Disable the HTTP server entirely with `http.enabled: false` to remove HTTP-based exposure, or restrict anonymous access by setting `anon-access: no-access` to limit disclosure to authenticated users only.

Technical details

Soft Serve fails to enforce read access checks on Go import metadata requests (go-get=1) and Git/LFS routes, allowing attackers to enumerate private repository names. A path walk-up to find repositories does not verify caller access, and inconsistent error responses (401 vs. 404) allow attackers to confirm private repository existence by name. Two LFS handlers dereference nil repositories when access checks are bypassed, causing panicked recoverable by the server.

Affected products

charmbracelet soft-serve v0.5.0 through v0.12.2

Timeline

2026-10-30: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.