{"id":"CVE-2026-104636","published":"2026-10-06T20:17:15.343","lastModified":"2026-10-07T21:17:09.133","description":"Gitea validated the initial remote URL for push mirrors, wiki remote checks, and fetches of migrated pull request heads, but the subsequent raw Git operations followed HTTP redirects without revalidating the destination. A repository administrator using a policy-allowed endpoint that redirects could make Gitea's Git client send requests to an address that the outbound host policy would otherwise block. The impact depends on the configured policy and the internal services reachable from the server.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cwes":["CWE-918"],"vendors":[],"products":[],"references":[{"url":"https://blog.gitea.com/release-of-28.0.0/","tags":[]},{"url":"https://github.com/go-gitea/gitea/pull/39426","tags":[]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","tags":[]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-g4hw-fg4c-89mq","tags":[]}],"exploitRefs":[{"url":"https://github.com/go-gitea/gitea/pull/39426","tags":[]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","tags":[]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-g4hw-fg4c-89mq","tags":[]}],"hasPoc":true,"ai":{"summary":"Gitea's Git client validates initial remote URLs but fails to revalidate destinations after HTTP redirects, allowing attackers to bypass outbound host policies and redirect requests to otherwise blocked internal services. This creates a potential vector for unauthorized access to internal systems through repository configuration.","exploitability":"Exploitation requires a repository administrator to configure a policy-allowed endpoint that redirects to a blocked destination, making it moderately difficult but possible with proper social engineering or misconfigured policies.","blast_radius":"The impact varies by configured policy but could allow access to internal services reachable from the Gitea server, potentially exposing sensitive data or systems behind firewalls.","remediation":"Upgrade to Gitea version 2.590 or later to receive the fix for CVE-2026-104636.","detection":"Monitor Git operation logs for unexpected redirect patterns in outbound HTTP requests, particularly when push mirrors, wiki remote checks, or pull request fetches are performed, looking for connections to non-policy-allowed endpoints that should have been blocked.","tags":["git","policy-bypass","redirect","access-control"],"model":"garnet-coder","analyzedAt":"2026-10-15T09:04:40.710Z"}}