Is CVE-2026-82556 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82556 being exploited in the wild.

How severe is CVE-2026-82556?

Medium severity, with a CVSS score of 6.3, published 30 August 2026.

Is there a fix for CVE-2026-82556?

A patch was published on 2026-08-30: Fix committed (b313bb83f5ff22bcc0378e0e0ca7bbd58303f168); backport to v15/v16 declined Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-82556 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-82556?

Check whether you run Forgejo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82556: Forgejo repository migration SSRF via DNS rebinding

CVE-2026-82556 · Severity: medium · CVSS 6.3 · Published 2026-08-30

Forgejo is a self-hosted Git platform used by organizations to manage source code repositories. A flaw in its migration feature allows authenticated users to bypass network access controls and trick the server into connecting to internal systems (including localhost and private networks) through DNS rebinding attacks. An attacker could access restricted Git repositories or internal services that should be unreachable through normal Forgejo operations.

Technologies: Forgejo. Vendors: Forgejo.

Quick answers

Is CVE-2026-82556 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82556 being exploited in the wild.
How severe is CVE-2026-82556?: Medium severity, with a CVSS score of 6.3, published 30 August 2026.
Which products and versions are affected?: Forgejo up to 15.0.4.
Is there a fix for CVE-2026-82556?: A patch was published on 2026-08-30: Fix committed (b313bb83f5ff22bcc0378e0e0ca7bbd58303f168); backport to v15/v16 declined Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82556 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-82556?: Check whether you run Forgejo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a time-of-check time-of-use (TOCTOU) vulnerability combined with server-side request forgery (SSRF) in Forgejo's repository migration handler. During URL validation, Forgejo performs a DNS lookup (net.LookupIP) to verify the destination is not a loopback or private address; however, the actual Git clone operation spawns an external git subprocess that performs an independent DNS resolution at connection time. An attacker controlling DNS responses (DNS rebinding) can return a public IP address during Forgejo's validation phase (causing it to accept the request), then return a loopback or internal IP when the Git subprocess connects, bypassing the allowlist. The vulnerability requires authentication and permission to create repositories with migration enabled. The fix (commit b313bb83f5ff22bcc0378e0e0ca7bbd58303f168) addresses this by ensuring the validated IP is bound to the actual network connection, though the maintainer declined to backport it to v15 and v16.

Affected products

Forgejo Forgejo up to 15.0.4

Timeline

2026-07-14: disclosed: Issue #13433 opened by lukehebe
2026-08-30: patched: Fix committed (b313bb83f5ff22bcc0378e0e0ca7bbd58303f168); backport to v15/v16 declined
2026-08-30: advisory: CVE-2026-82556 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.