Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Informational severity, published 5 November 2026.

Which products and versions are affected?

Charmbracelet Soft-Serve 0.5.0 to 0.12.2; github.com/charmbracelet/soft-serve (Go) SEMVER:introduced=0.5.0,fixed=0.12.3.

Is there a fix for This vulnerability?

Yes. github.com/charmbracelet/soft-serve (Go): upgrade to 0.12.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network.

Check whether you run Charmbracelet Soft-Serve or github.com/charmbracelet/soft-serve (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

charmbracelet soft-serve information disclosure of private repository names

Severity: info · Published 2026-11-05

Soft Serve is a Git server that allows users to host repositories over HTTP and SSH. The vulnerability allows unauthenticated remote attackers to discover the existence and exact names of private repositories through specially crafted HTTP requests, potentially exposing sensitive internal project names, codenames, or customer information.

Technologies: Charmbracelet Soft-Serve, github.com/charmbracelet/soft-serve (Go). Vendors: Charmbracelet, Go.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Informational severity, published 5 November 2026.
Which products and versions are affected?: Charmbracelet Soft-Serve 0.5.0 to 0.12.2; github.com/charmbracelet/soft-serve (Go) SEMVER:introduced=0.5.0,fixed=0.12.3.
Is there a fix for This vulnerability?: Yes. github.com/charmbracelet/soft-serve (Go): upgrade to 0.12.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network.
Am I affected?: Check whether you run Charmbracelet Soft-Serve or github.com/charmbracelet/soft-serve (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/charmbracelet/soft-serve (Go): upgrade to 0.12.3 or later
```
go get github.com/charmbracelet/soft-serve@v0.12.3
```

Technical details

The vulnerability exists in Soft Serve's handling of go-get requests and Git/LFS routes. The access control logic in withAccess middleware allows go-get requests to bypass authorization checks meant to hide repositories, and GoGetHandler walks the path to find repositories without verifying the caller has read access. Additionally, Git and LFS routes leak repository existence through inconsistent HTTP response codes: missing repos return 404 while private repos return 401, allowing enumeration of private repository names.

Affected products

charmbracelet soft-serve 0.5.0 to 0.12.2

Identifiers

GHSA-fgxm-5hvv-x4vh
GO-2026-6892

Timeline

2026-10-05: disclosed
2026-10-05: patched: fixed in release v0.12.3
2026-11-05: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.