Charmbracelet soft-serve race condition in SetPrivate leaves private repositories readable

Severity: info · Published 2026-11-05

Soft Serve is a Git server that allows administrators to control repository access. Due to a race condition in how it caches repository visibility settings, an attacker can exploit the brief window when an operator marks a repository private to permanently read it—including all future commits—until the server restarts. The attacker needs only anonymous read access, no account, and no special timing knowledge.

Technologies: Charmbracelet Soft-Serve, github.com/charmbracelet/soft-serve (Go). Vendors: Charmbracelet, Go.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Informational severity, published 5 November 2026.
Which products and versions are affected?
Charmbracelet Soft-Serve 0.6.0 through 0.12.2; github.com/charmbracelet/soft-serve (Go) SEMVER:introduced=0.6.0,fixed=0.12.3.
Is there a fix for This vulnerability?
Yes. github.com/charmbracelet/soft-serve (Go): upgrade to 0.12.3 or later. Until then: Restart the server to clear stale cached records and restore correct access checks. Operators unable to upgrade immediately should create repositories as private from the start rather than converting public ones, and avoid changing visibility while the server is serving traffic. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network, in a hosted service.
Am I affected?
Check whether you run Charmbracelet Soft-Serve or github.com/charmbracelet/soft-serve (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/charmbracelet/soft-serve (Go): upgrade to 0.12.3 or later
    go get github.com/charmbracelet/soft-serve@v0.12.3

Restart the server to clear stale cached records and restore correct access checks. Operators unable to upgrade immediately should create repositories as private from the start rather than converting public ones, and avoid changing visibility while the server is serving traffic.

Technical details

The vulnerability is a race condition in the SetPrivate function combined with an unbounded in-memory cache of repository metadata. The cache was cleared before the database transaction that updates visibility, allowing a concurrent request between the clear and commit to read the stale cached value and re-populate the cache with outdated information. This affects single and multi-process deployments; the latter experience persistent stale caches across all processes. The fix in v0.12.3 removes the cache entirely, ensuring access checks always read the current database state.

Affected products

  • Charmbracelet soft-serve 0.6.0 through 0.12.2

Identifiers

  • GHSA-f3fj-9625-rv3m
  • GO-2026-6891

Timeline

  • 2026-10-05: disclosed
  • 2026-10-26: patched: v0.12.3 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.