# CVE-2026-54481: Gitea improper certificate validation in internal API client

Source: https://junglewise.ai/threats/cve-2026-54481-gitea-improper-certificate-validation-in-internal-api-client  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-21. Updated: 2026-07-21  
License: CC BY 4.0 with a link back

CVE-2026-54481 · Severity: high · CVSS 7.5 · Published 2026-07-21

Gitea is an open-source forge software for hosting software development version control. A security flaw in its internal communication system allows the software to trust any security certificate when connecting to its own internal API over HTTPS. In certain complex network setups, an attacker could intercept this connection to steal a high-privilege administrative token, potentially allowing them to take full control of the server, modify code repositories, or shut down the service.

Technologies: [Gitea](https://junglewise.ai/threats/technologies/gitea), [code.gitea.io/gitea (Go)](https://junglewise.ai/threats/technologies/code-gitea-io-gitea), [gitea.dev (Go)](https://junglewise.ai/threats/technologies/gitea-dev). Vendors: [Gitea](https://junglewise.ai/threats/vendors/gitea), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-54481 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54481 being exploited in the wild.

**How severe is CVE-2026-54481?** High severity, with a CVSS score of 7.5, published 21 July 2026.

**Which products and versions are affected?** Gitea < 1.27.0; code.gitea.io/gitea (Go) < 1.27.0, SEMVER:introduced=0,fixed=1.27.0; gitea.dev (Go) SEMVER:introduced=0,fixed=1.27.0.

**Is there a fix for CVE-2026-54481?** Yes. code.gitea.io/gitea (Go): upgrade to 1.27.0 or later; gitea.dev (Go): upgrade to 1.27.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54481 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-54481?** Check whether you run Gitea, code.gitea.io/gitea (Go) or gitea.dev (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- code.gitea.io/gitea (Go): upgrade to 1.27.0 or later

  ```sh
  go get code.gitea.io/gitea@v1.27.0
  ```

- gitea.dev (Go): upgrade to 1.27.0 or later

  ```sh
  go get gitea.dev@v1.27.0
  ```


## Technical details

The Gitea internal API HTTP client in `modules/private/internal.go` hardcodes `InsecureSkipVerify: true` in its TLS configuration, preventing peer certificate validation. When `LOCAL_ROOT_URL` is configured with HTTPS in a multi-host or containerized environment, subprocesses like `gitea serv` or `gitea hook` communicate with the internal API without verifying the server's identity. An attacker with on-path network access can perform a Man-in-the-Middle (MitM) attack to capture the static `INTERNAL_TOKEN` passed in the `X-Gitea-Internal-Auth` header. This token grants full access to internal administrative endpoints, including process management, SSH key authorization, and git command execution. The vulnerability is patched in version 1.27.0.

## Affected products

- Gitea Gitea < 1.27.0

## Identifiers

- CVE-2026-54481
- GHSA-94v3-77j7-vm48
- GO-2026-6048

## Timeline

- 2026-06-13: other: Vulnerability verified against main branch
- 2026-07-13: advisory: GitHub Advisory published
- 2026-07-21: patched: Advisory updated with patch information

## References

- [https://api.github.com/users/sanil18](https://api.github.com/users/sanil18)
- [https://github.com/sanil18](https://github.com/sanil18)
- [https://api.github.com/users/sanil18/gists%7B/gist_id%7D](https://api.github.com/users/sanil18/gists%7B/gist_id%7D)
- [https://api.github.com/users/sanil18/repos](https://api.github.com/users/sanil18/repos)
- [https://avatars.githubusercontent.com/u/153499798?v=4](https://avatars.githubusercontent.com/u/153499798?v=4)
- [https://api.github.com/users/sanil18/events%7B/privacy%7D](https://api.github.com/users/sanil18/events%7B/privacy%7D)

## Related threats

- [Gitea account takeover via OAuth2 auto-linking](https://junglewise.ai/threats/cve-2026-120263-when-oauth2-client-account-linking-is-set-to-auto-not-the)
- [Gitea limited-visibility profile disclosure via public-only token](https://junglewise.ai/threats/cve-2026-119627-the-web-profile-and-rss-atom-feed-routes-of-users-and)
- [Gitea token scope bypass in web routes](https://junglewise.ai/threats/cve-2026-119625-the-username-web-route-accepted-personal-access-tokens-over-http)
- [Gitea project boards information disclosure of private pull requests](https://junglewise.ai/threats/cve-2026-119533-repository-and-organization-project-boards-listed-the-pull)
- [Gitea API token scope bypass in repository deletion](https://junglewise.ai/threats/cve-2026-119441-delete-api-v1-orgs-org-repos-deletes-all-repositories-of-an)