Is CVE-2026-58314 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-58314 being exploited in the wild.

How severe is CVE-2026-58314?

High severity, with a CVSS score of 7.7, published 21 July 2026.

Which products and versions are affected?

Gitea < 1.27.0; code.gitea.io/gitea (Go) < 1.27.0, SEMVER:introduced=0,fixed=1.27.0; gitea.dev (Go) SEMVER:introduced=0,fixed=1.27.0.

Is there a fix for CVE-2026-58314?

Yes. code.gitea.io/gitea (Go): upgrade to 1.27.0 or later; gitea.dev (Go): upgrade to 1.27.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-58314 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-58314?

Check whether you run Gitea, code.gitea.io/gitea (Go) or gitea.dev (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-58314: Gitea SSRF in webhooks and OpenID discovery

Q: Which products and versions are affected?

Gitea < 1.27.0; code.gitea.io/gitea (Go) < 1.27.0, SEMVER:introduced=0,fixed=1.27.0; gitea.dev (Go) SEMVER:introduced=0,fixed=1.27.0.

Q: Is there a fix for CVE-2026-58314?

Yes. code.gitea.io/gitea (Go): upgrade to 1.27.0 or later; gitea.dev (Go): upgrade to 1.27.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-58314 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-58314?

Check whether you run Gitea, code.gitea.io/gitea (Go) or gitea.dev (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-58314 · Severity: high · CVSS 7.7 · Published 2026-07-21

Gitea, a popular self-hosted Git service, contains two security flaws that allow attackers to bypass network restrictions. These vulnerabilities enable attackers to force the Gitea server to make requests to internal network services that should be private, potentially exposing sensitive internal data, configuration headers, or allowing for internal port scanning. This could lead to the compromise of internal infrastructure that is not directly accessible from the internet.

Technologies: Gitea, code.gitea.io/gitea (Go), gitea.dev (Go). Vendors: Gitea, Go.

Quick answers

Is CVE-2026-58314 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-58314 being exploited in the wild.
How severe is CVE-2026-58314?: High severity, with a CVSS score of 7.7, published 21 July 2026.
Which products and versions are affected?: Gitea < 1.27.0; code.gitea.io/gitea (Go) < 1.27.0, SEMVER:introduced=0,fixed=1.27.0; gitea.dev (Go) SEMVER:introduced=0,fixed=1.27.0.
Is there a fix for CVE-2026-58314?: Yes. code.gitea.io/gitea (Go): upgrade to 1.27.0 or later; gitea.dev (Go): upgrade to 1.27.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-58314 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-58314?: Check whether you run Gitea, code.gitea.io/gitea (Go) or gitea.dev (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

code.gitea.io/gitea (Go): upgrade to 1.27.0 or later
```
go get code.gitea.io/gitea@v1.27.0
```
gitea.dev (Go): upgrade to 1.27.0 or later
```
go get gitea.dev@v1.27.0
```

Technical details

Two SSRF vulnerabilities were identified in Gitea. First, the 'hostmatcher' component, used for webhooks and repo migrations, fails to block several non-routable address families, most notably CGNAT (100.64.0.0/10). This allows authenticated users to exfiltrate up to 1MB of response data from internal services. Second, the OpenID sign-in endpoint (/user/login/openid) uses a default HTTP client without any IP filtering or CSRF protection, allowing unauthenticated attackers to perform blind SSRF against internal targets. The root cause is a reliance on Go's net.IP.IsPrivate() which does not cover all reserved ranges, and a failure to apply the hostmatcher to the OpenID discovery process. These issues are addressed in version 1.27.0.

Affected products

Gitea Gitea < 1.27.0

Identifiers

CVE-2026-58314
GHSA-2fcr-jfvc-vgg2
GO-2026-6038

Timeline

2026-07-13: advisory: Initial GitHub Advisory published
2026-07-21: patched: Updated with patch information for version 1.27.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.