Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Medium severity, with a CVSS score of 5.9, published 30 October 2026.

Which products and versions are affected?

Charmbracelet Soft-Serve v0.6.0 through v0.12.2; github.com/charmbracelet/soft-serve (Go) >= 0.6.0, < 0.12.3, SEMVER:introduced=0.6.0,fixed=0.12.3.

How is This vulnerability attacked?

It is attacked over the network.

Check whether you run Charmbracelet Soft-Serve or github.com/charmbracelet/soft-serve (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

charmbracelet soft-serve race condition in SetPrivate

Q: Is there a fix for This vulnerability?

Yes. github.com/charmbracelet/soft-serve (Go): upgrade to 0.12.3 or later. Until then: Operators unable to upgrade immediately should create repositories as private from the start using `repo create -p` rather than making public ones private, and avoid changing repository visibility while the server is actively serving traffic. Restarting the server will clear stale cached records. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked over the network.

Q: Am I affected?

Check whether you run Charmbracelet Soft-Serve or github.com/charmbracelet/soft-serve (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: medium · CVSS 5.9 · Published 2026-10-30

Soft Serve is a Git server that organizations use to host repositories. Due to a race condition when changing a repository from public to private, an attacker can continue reading the repository and all future commits after the operator makes it private. The attacker needs no credentials and simply polls the repository periodically to keep reading it indefinitely until the server restarts.

Technologies: Charmbracelet Soft-Serve, github.com/charmbracelet/soft-serve (Go). Vendors: Charmbracelet, Go.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Medium severity, with a CVSS score of 5.9, published 30 October 2026.
Which products and versions are affected?: Charmbracelet Soft-Serve v0.6.0 through v0.12.2; github.com/charmbracelet/soft-serve (Go) >= 0.6.0, < 0.12.3, SEMVER:introduced=0.6.0,fixed=0.12.3.
Is there a fix for This vulnerability?: Yes. github.com/charmbracelet/soft-serve (Go): upgrade to 0.12.3 or later. Until then: Operators unable to upgrade immediately should create repositories as private from the start using `repo create -p` rather than making public ones private, and avoid changing repository visibility while the server is actively serving traffic. Restarting the server will clear stale cached records. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network.
Am I affected?: Check whether you run Charmbracelet Soft-Serve or github.com/charmbracelet/soft-serve (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/charmbracelet/soft-serve (Go): upgrade to 0.12.3 or later
```
go get github.com/charmbracelet/soft-serve@v0.12.3
```

Operators unable to upgrade immediately should create repositories as private from the start using `repo create -p` rather than making public ones private, and avoid changing repository visibility while the server is actively serving traffic. Restarting the server will clear stale cached records.

Technical details

A race condition exists in the `SetPrivate` function where the in-memory cache is cleared before the database is updated. If a request reads the old row from the database after the cache delete but before the transaction commits, it caches the stale public record. Subsequent access checks use this stale record, bypassing private repository restrictions. The vulnerability affects all authenticated and unauthenticated access over HTTP, SSH, and git:// protocols and persists until server restart.

Affected products

charmbracelet soft-serve v0.6.0 through v0.12.2

Timeline

2026-10-30: disclosed: Vulnerability advisory published
2026-10-30: patched: Fixed in v0.12.3

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.