Is CVE-2026-54481 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54481 being exploited in the wild.

How severe is CVE-2026-54481?

High severity, with a CVSS score of 7.5, published 21 July 2026.

Which products and versions are affected?

Gitea < 1.27.0; code.gitea.io/gitea (Go) < 1.27.0, SEMVER:introduced=0,fixed=1.27.0; gitea.dev (Go) SEMVER:introduced=0,fixed=1.27.0.

Is there a fix for CVE-2026-54481?

Yes. code.gitea.io/gitea (Go): upgrade to 1.27.0 or later; gitea.dev (Go): upgrade to 1.27.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54481 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-54481?

Check whether you run Gitea, code.gitea.io/gitea (Go) or gitea.dev (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54481: Gitea improper certificate validation in internal API client

Q: Which products and versions are affected?

Gitea < 1.27.0; code.gitea.io/gitea (Go) < 1.27.0, SEMVER:introduced=0,fixed=1.27.0; gitea.dev (Go) SEMVER:introduced=0,fixed=1.27.0.

Q: Is there a fix for CVE-2026-54481?

Yes. code.gitea.io/gitea (Go): upgrade to 1.27.0 or later; gitea.dev (Go): upgrade to 1.27.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-54481 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-54481?

Check whether you run Gitea, code.gitea.io/gitea (Go) or gitea.dev (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54481 · Severity: high · CVSS 7.5 · Published 2026-07-21

Gitea is an open-source forge software for hosting software development version control. A security flaw in its internal communication system allows the software to trust any security certificate when connecting to its own internal API over HTTPS. In certain complex network setups, an attacker could intercept this connection to steal a high-privilege administrative token, potentially allowing them to take full control of the server, modify code repositories, or shut down the service.

Technologies: Gitea, code.gitea.io/gitea (Go), gitea.dev (Go). Vendors: Gitea, Go.

Quick answers

Is CVE-2026-54481 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54481 being exploited in the wild.
How severe is CVE-2026-54481?: High severity, with a CVSS score of 7.5, published 21 July 2026.
Which products and versions are affected?: Gitea < 1.27.0; code.gitea.io/gitea (Go) < 1.27.0, SEMVER:introduced=0,fixed=1.27.0; gitea.dev (Go) SEMVER:introduced=0,fixed=1.27.0.
Is there a fix for CVE-2026-54481?: Yes. code.gitea.io/gitea (Go): upgrade to 1.27.0 or later; gitea.dev (Go): upgrade to 1.27.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54481 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-54481?: Check whether you run Gitea, code.gitea.io/gitea (Go) or gitea.dev (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

code.gitea.io/gitea (Go): upgrade to 1.27.0 or later
```
go get code.gitea.io/gitea@v1.27.0
```
gitea.dev (Go): upgrade to 1.27.0 or later
```
go get gitea.dev@v1.27.0
```

Technical details

The Gitea internal API HTTP client in `modules/private/internal.go` hardcodes `InsecureSkipVerify: true` in its TLS configuration, preventing peer certificate validation. When `LOCAL_ROOT_URL` is configured with HTTPS in a multi-host or containerized environment, subprocesses like `gitea serv` or `gitea hook` communicate with the internal API without verifying the server's identity. An attacker with on-path network access can perform a Man-in-the-Middle (MitM) attack to capture the static `INTERNAL_TOKEN` passed in the `X-Gitea-Internal-Auth` header. This token grants full access to internal administrative endpoints, including process management, SSH key authorization, and git command execution. The vulnerability is patched in version 1.27.0.

Affected products

Gitea Gitea < 1.27.0

Identifiers

CVE-2026-54481
GHSA-94v3-77j7-vm48
GO-2026-6048

Timeline

2026-06-13: other: Vulnerability verified against main branch
2026-07-13: advisory: GitHub Advisory published
2026-07-21: patched: Advisory updated with patch information

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.