Is CVE-2026-58426 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-58426 being exploited in the wild.

How severe is CVE-2026-58426?

Critical severity, with a CVSS score of 9.6, published 3 July 2026.

Which products and versions are affected?

Gitea >= 1.22.0, = 1.22.0, = 1.22.0, < 1.26.2, SEMVER:introduced=1.22.0,fixed=1.26.2.

Is there a fix for CVE-2026-58426?

Yes. code.gitea.io/gitea (Go): upgrade to 1.26.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-58426 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-58426?

Check whether you run Gitea or code.gitea.io/gitea (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-58426: Gitea Actions HMAC ambiguity in Artifacts V4 signed URLs

Q: Is there a fix for CVE-2026-58426?

Yes. code.gitea.io/gitea (Go): upgrade to 1.26.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-58426 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-58426?

Check whether you run Gitea or code.gitea.io/gitea (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-58426 · Severity: critical · CVSS 9.6 · Published 2026-07-03

Gitea is a popular self-hosted software development platform. A security flaw in its Actions component allows an attacker with permission to run a job to access or modify data belonging to other users or private repositories. This could lead to the theft of sensitive build artifacts or the injection of malicious code into other projects' deployment pipelines.

Technologies: Gitea, code.gitea.io/gitea (Go). Vendors: Gitea, Go.

Quick answers

Is CVE-2026-58426 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-58426 being exploited in the wild.
How severe is CVE-2026-58426?: Critical severity, with a CVSS score of 9.6, published 3 July 2026.
Which products and versions are affected?: Gitea >= 1.22.0, < 1.26.2, >= 1.22.0, <= 1.26.1; code.gitea.io/gitea (Go) >= 1.22.0, < 1.26.2, SEMVER:introduced=1.22.0,fixed=1.26.2.
Is there a fix for CVE-2026-58426?: Yes. code.gitea.io/gitea (Go): upgrade to 1.26.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-58426 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-58426?: Check whether you run Gitea or code.gitea.io/gitea (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

code.gitea.io/gitea (Go): upgrade to 1.26.2 or later
```
go get code.gitea.io/gitea@v1.26.2
```

Technical details

A cryptographic ambiguity exists in Gitea Actions Artifacts V4 due to the insecure concatenation of fields (artifactName, taskID, and artifactID) when generating HMAC signatures for upload and download URLs. Because these fields are concatenated without delimiters or length-prefixing, an attacker can craft overlapping values that result in the same HMAC input, effectively forging a valid signature for a different task or repository. After signature verification, the server trusts URL-controlled parameters to look up the target artifact without re-verifying repository access. This allows an authenticated attacker to read private artifacts or write data into the staging area of another task's artifact. The vulnerability is patched in version 1.26.2.

Affected products

Gitea Gitea >= 1.22.0, < 1.26.2

Identifiers

CVE-2026-58426
GHSA-hg5r-vq93-9fv6
GO-2026-6060

Timeline

2026-07-01: disclosed
2026-07-21: advisory
1.26.2: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.