# charmbracelet soft-serve information disclosure of private repository names

Source: https://junglewise.ai/threats/go-2026-6892-charmbracelet-soft-serve-http-responses-disclose-the-a9c42c70  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-05. Updated: 2026-11-07  
License: CC BY 4.0 with a link back

Severity: info · Published 2026-11-05

Soft Serve is a Git server that allows users to host repositories over HTTP and SSH. The vulnerability allows unauthenticated remote attackers to discover the existence and exact names of private repositories through specially crafted HTTP requests, potentially exposing sensitive internal project names, codenames, or customer information.

Technologies: [Charmbracelet Soft-Serve](https://junglewise.ai/threats/technologies/charmbracelet-soft-serve), [github.com/charmbracelet/soft-serve (Go)](https://junglewise.ai/threats/technologies/github-com-charmbracelet-soft-serve). Vendors: [Charmbracelet](https://junglewise.ai/threats/vendors/charmbracelet), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 5 November 2026.

**Which products and versions are affected?** Charmbracelet Soft-Serve 0.5.0 to 0.12.2; github.com/charmbracelet/soft-serve (Go) SEMVER:introduced=0.5.0,fixed=0.12.3.

**Is there a fix for This vulnerability?** Yes. github.com/charmbracelet/soft-serve (Go): upgrade to 0.12.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network.

**Am I affected?** Check whether you run Charmbracelet Soft-Serve or github.com/charmbracelet/soft-serve (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/charmbracelet/soft-serve (Go): upgrade to 0.12.3 or later

  ```sh
  go get github.com/charmbracelet/soft-serve@v0.12.3
  ```


## Technical details

The vulnerability exists in Soft Serve's handling of go-get requests and Git/LFS routes. The access control logic in withAccess middleware allows go-get requests to bypass authorization checks meant to hide repositories, and GoGetHandler walks the path to find repositories without verifying the caller has read access. Additionally, Git and LFS routes leak repository existence through inconsistent HTTP response codes: missing repos return 404 while private repos return 401, allowing enumeration of private repository names.

## Affected products

- charmbracelet soft-serve 0.5.0 to 0.12.2

## Identifiers

- GHSA-fgxm-5hvv-x4vh
- GO-2026-6892

## Timeline

- 2026-10-05: disclosed
- 2026-10-05: patched: fixed in release v0.12.3
- 2026-11-05: advisory

## References

- [https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-fgxm-5hvv-x4vh](https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-fgxm-5hvv-x4vh)
- [https://github.com/charmbracelet/soft-serve/commit/74e41543304d1e12fd54fc59e410bd428373dd34](https://github.com/charmbracelet/soft-serve/commit/74e41543304d1e12fd54fc59e410bd428373dd34)

## Related threats

- [Charmbracelet soft-serve race condition in SetPrivate leaves private repositories readable](https://junglewise.ai/threats/go-2026-6891-charmbracelet-soft-serve-race-in-setprivate-leaves-a-cabb0105)
- [charmbracelet soft-serve race condition in SetPrivate](https://junglewise.ai/threats/charmbracelet-soft-serve-race-in-setprivate-leaves-a-private-repository-ff0fdf2d)
- [charmbracelet soft-serve repository name disclosure via HTTP](https://junglewise.ai/threats/charmbracelet-soft-serve-http-responses-disclose-the-existence-and-d0036784)
- [In Soft Serve, an authenticated repo import can clone server-local private repositories](https://junglewise.ai/threats/cve-2026-33353-in-soft-serve-an-authenticated-repo-import-can-clone-server-local)
- [GO-2026-4634 - soft-serve vulnerable to SSRF via unvalidated LFS endpoint in repo import in github.com/charmbracelet/soft-serve](https://junglewise.ai/threats/cve-2026-30832-soft-serve-vulnerable-to-ssrf-via-unvalidated-lfs-endpoint-in)