{"id":"CVE-2026-103059","published":"2026-10-06T20:17:14.377","lastModified":"2026-10-07T15:16:56.737","description":"When Gitea's built-in SSH server is enabled (`START_SSH_SERVER = true`), the presented public key was looked up with an SQL `LIKE` comparison of its encoded content, which is case-insensitive on some databases, including the default SQLite. An attacker who can construct a case variant of another user's registered RSA public key for which they can derive the private key could have that key matched to the victim's account and authenticate over SSH as that user. Keys are now looked up by fingerprint.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-305"],"vendors":[],"products":[],"references":[{"url":"https://blog.gitea.com/release-of-28.0.0/","tags":[]},{"url":"https://github.com/go-gitea/gitea/pull/39423","tags":[]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","tags":[]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-8pwg-hcgm-54cp","tags":[]}],"exploitRefs":[{"url":"https://github.com/go-gitea/gitea/pull/39423","tags":[]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","tags":[]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-8pwg-hcgm-54cp","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows an attacker to exploit a case-insensitive SQL `LIKE` comparison in Gitea's SSH server, potentially matching a crafted public key to a victim's account and gaining SSH access.","exploitability":"Exploitation is moderately hard as it requires constructing a case variant of the victim's public key and having knowledge of the private key. Precondition is the `START_SSH_SERVER` must be enabled.","blast_radius":"If exploited, the attacker could gain full SSH access to the victim's account, potentially leading to data theft or system compromise.","remediation":"Disable the built-in SSH server by setting `START_SSH_SERVER = false` in the Gitea configuration.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","ssh","sql-injection","gitea"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-08T08:41:00.108Z"}}