Executive brief
Forgejo is a self-hosted Git platform used by organizations to manage source code repositories. A flaw in its migration feature allows authenticated users to bypass network access controls and trick the server into connecting to internal systems (including localhost and private networks) through DNS rebinding attacks. An attacker could access restricted Git repositories or internal services that should be unreachable through normal Forgejo operations.
Technical details
This is a time-of-check time-of-use (TOCTOU) vulnerability combined with server-side request forgery (SSRF) in Forgejo's repository migration handler. During URL validation, Forgejo performs a DNS lookup (net.LookupIP) to verify the destination is not a loopback or private address; however, the actual Git clone operation spawns an external git subprocess that performs an independent DNS resolution at connection time. An attacker controlling DNS responses (DNS rebinding) can return a public IP address during Forgejo's validation phase (causing it to accept the request), then return a loopback or internal IP when the Git subprocess connects, bypassing the allowlist. The vulnerability requires authentication and permission to create repositories with migration enabled. The fix (commit b313bb83f5ff22bcc0378e0e0ca7bbd58303f168) addresses this by ensuring the validated IP is bound to the actual network connection, though the maintainer declined to backport it to v15 and v16.
Affected products
- Forgejo Forgejo up to 15.0.4
Timeline
- 2026-07-14: disclosed: Issue #13433 opened by lukehebe
- 2026-08-30: patched: Fix committed (b313bb83f5ff22bcc0378e0e0ca7bbd58303f168); backport to v15/v16 declined
- 2026-08-30: advisory: CVE-2026-82556 published