Executive brief
Gitea is an open-source forge software for hosting software development version control. A security flaw in its internal communication system allows the software to trust any security certificate when connecting to its own internal API over HTTPS. In certain complex network setups, an attacker could intercept this connection to steal a high-privilege administrative token, potentially allowing them to take full control of the server, modify code repositories, or shut down the service.
Technical details
The Gitea internal API HTTP client in `modules/private/internal.go` hardcodes `InsecureSkipVerify: true` in its TLS configuration, preventing peer certificate validation. When `LOCAL_ROOT_URL` is configured with HTTPS in a multi-host or containerized environment, subprocesses like `gitea serv` or `gitea hook` communicate with the internal API without verifying the server's identity. An attacker with on-path network access can perform a Man-in-the-Middle (MitM) attack to capture the static `INTERNAL_TOKEN` passed in the `X-Gitea-Internal-Auth` header. This token grants full access to internal administrative endpoints, including process management, SSH key authorization, and git command execution. The vulnerability is patched in version 1.27.0.
Affected products
- Gitea Gitea < 1.27.0
Timeline
- 2026-06-13: other: Vulnerability verified against main branch
- 2026-07-13: advisory: GitHub Advisory published
- 2026-07-21: patched: Advisory updated with patch information