Executive brief
Soft Serve Public Key Authentication Bypass Vulnerability when Keyboard-Interactive SSH Authentication is Enabled in github.com/charmbracelet/soft-serve
Affected products
- Go github.com/charmbracelet/soft-serve
Junglewise Threat Intelligence
CVE-2023-43809: GO-2023-2097 - Soft Serve Public Key Authentication Bypass Vulnerability when Keyboard-Interactive SSH Authentication is Enabled in github.com/charmbracele
CVE-2023-43809 · Severity: low · CVSS 3.1 · Published 2024-08-21
Technologies: github.com/charmbracelet/soft-serve (Go). Vendors: Go.
Related threats
- GO-2026-4788 - In Soft Serve, an authenticated repo import can clone server-local private repositories in github.com/charmbracelet/soft-serve
- GO-2026-4634 - soft-serve vulnerable to SSRF via unvalidated LFS endpoint in repo import in github.com/charmbracelet/soft-serve
- GO-2026-4353 - Soft Serve Affected by an Authentication Bypass in github.com/charmbracelet/soft-serve
- GO-2026-4290 - Soft Serve is missing an authorization check in LFS lock deletion in github.com/charmbracelet/soft-serve
- GO-2025-4106 - Soft Serve does not sanitize ANSI escape sequences in user input in github.com/charmbracelet/soft-serve