Junglewise Threat Intelligence

CVE-2026-13540: GitBucket SSRF in RepositoryCreationService

CVE-2026-13540 · Severity: medium · CVSS 6.3 · Published 2026-06-29

Executive brief

GitBucket, a self-hosted Git platform, is vulnerable to a security flaw that allows authenticated users to force the server to make unauthorized requests to other internal or external systems. By providing a malicious URL when creating a new repository, an attacker can bypass network restrictions to scan internal infrastructure or access sensitive cloud metadata. This could lead to the exposure of internal service information or cloud credentials, potentially compromising the broader corporate network.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in GitBucket up to version 4.46.1 within the `Git.cloneRepository.setURI` function in `RepositoryCreationService.scala`. The application fails to validate the `sourceUrl` parameter when a user selects the 'Copy existing git repository' option during repository creation. An authenticated attacker can provide a malicious URL (e.g., pointing to internal RFC-1918 addresses or cloud IMDS endpoints like 169.254.169.254), which JGit then attempts to clone, resulting in an outbound HTTP request from the server. This can be used for internal port scanning or credential theft from cloud environments. The issue is addressed in version 4.47.0 and via patch 487a9b980f56aa73b6a044b1e86a92eed5043215.

Affected products

  • GitBucket GitBucket Up to 4.46.1

Timeline

  • 2026-06-06: disclosed: Issue reported on GitHub by geo-chen
  • 2026-06-20: patched: Fix merged into master branch and targeted for 4.47.0
  • 2026-06-29: advisory: CVE published to NVD dataset

References

Related threats