{"id":"CVE-2026-101027","published":"2026-10-06T20:17:08.233","lastModified":"2026-10-07T16:17:31.953","description":"When `[migrations] ALLOWED_DOMAINS` was configured, a hostname matching the allow list was accepted without checking its resolved address against the local-network restrictions. A user who can start repository migrations and control the DNS of an allowed hostname could make it resolve to loopback or private addresses and bypass `ALLOW_LOCALNETWORKS = false`, reaching internal services from the Gitea server. Instances without `ALLOWED_DOMAINS` configured are not affected by this specific bypass.","cvssScore":7.7,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cwes":["CWE-346"],"vendors":[],"products":[],"references":[{"url":"https://blog.gitea.com/release-of-28.0.0/","tags":[]},{"url":"https://github.com/go-gitea/gitea/pull/39426","tags":[]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","tags":[]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-fqjr-23c8-gg9m","tags":[]}],"exploitRefs":[{"url":"https://github.com/go-gitea/gitea/pull/39426","tags":[]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","tags":[]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-fqjr-23c8-gg9m","tags":[]}],"hasPoc":true,"ai":{"summary":"A Gitea instance configured with ALLOWED_DOMAINS for migrations can be tricked into migrating to internal services by using DNS hijacking to point allowed hostnames to loopback or private IP addresses, bypassing local network restrictions. This allows attackers to access internal services that should normally be unreachable from the external migration endpoint.","exploitability":"Exploitation requires a user with repository migration privileges who can control DNS for an allowed hostname, making it resolve to internal addresses; this is moderately difficult but possible in many environments.","blast_radius":"The impact could be significant as attackers could potentially access internal services like databases, APIs, or other sensitive systems that are normally protected by local network restrictions.","remediation":"Upgrade to Gitea version 2.590 or later to fix this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["misconfiguration","network-restriction-bypass","migration"],"model":"garnet-coder","analyzedAt":"2026-10-15T09:00:38.528Z"}}