CVE-2026-59765: Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher , Reads Internal Files and Cloud Metadata

CVE-2026-59765 · Severity: high · CVSS 7.6 · Published 2026-08-05

Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply arbitrary URLs through release asset download URLs, pull-request patch URLs, or OAuth avatar endpoints to reach internal services, cloud instance-metadata endpoints, or read local files such as the application configuration containing database credentials and signing secrets, with exfiltrated content persisted as migration release assets for later retrieval.

Technologies: code.gitea.io/gitea (Go), gitea.dev (Go). Vendors: Go.

Quick answers

Is CVE-2026-59765 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-59765 being exploited in the wild.
How severe is CVE-2026-59765?
High severity, with a CVSS score of 7.6, published 5 August 2026.
Which products and versions are affected?
code.gitea.io/gitea (Go) SEMVER:introduced=0,fixed=1.27.0; gitea.dev (Go) SEMVER:introduced=0,fixed=1.27.0.
Is there a fix for CVE-2026-59765?
Yes. code.gitea.io/gitea (Go): upgrade to 1.27.0 or later; gitea.dev (Go): upgrade to 1.27.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2026-59765?
Check whether you run code.gitea.io/gitea (Go) or gitea.dev (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • code.gitea.io/gitea (Go): upgrade to 1.27.0 or later
    go get code.gitea.io/gitea@v1.27.0
  • gitea.dev (Go): upgrade to 1.27.0 or later
    go get gitea.dev@v1.27.0

Affected products

  • code.gitea.io/gitea (Go) SEMVER:introduced=0,fixed=1.27.0
  • gitea.dev (Go) SEMVER:introduced=0,fixed=1.27.0

Identifiers

  • CVE-2026-59765
  • CVE-2026-34966
  • GHSA-2wm4-vwp6-v7xc
  • GO-2026-6039

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.