{"id":"CVE-2026-70357","published":"2026-10-06T20:17:28.883","lastModified":"2026-10-07T21:17:16.520","description":"Gitea validates a repository migration hostname against its network allow and block lists before invoking Git, but the Git subprocess independently resolves the hostname when connecting. An attacker who can start a migration and control the destination's DNS can change the address between validation and connection to reach a blocked internal address. The affected path is the Git clone operation; validation in the migration HTTP client's dialer does not protect the independently connecting Git subprocess.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cwes":["CWE-918"],"vendors":[],"products":[],"references":[{"url":"https://blog.gitea.com/release-of-28.0.0/","tags":[]},{"url":"https://github.com/go-gitea/gitea/pull/39426","tags":[]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","tags":[]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-p3pc-g8m5-hrrr","tags":[]}],"exploitRefs":[{"url":"https://github.com/go-gitea/gitea/pull/39426","tags":[]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","tags":[]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-p3pc-g8m5-hrrr","tags":[]}],"hasPoc":true,"ai":{"summary":"Gitea's repository migration feature fails to protect against DNS rebinding attacks where an attacker can manipulate DNS resolution between hostname validation and actual Git connection, potentially allowing access to internally blocked repositories. This creates a window where validated external hostnames can be redirected to internal addresses that would otherwise be blocked.","exploitability":"Moderately difficult to exploit as it requires controlling DNS for the destination hostname during migration, but attackers can leverage this to bypass network allow/block lists by changing DNS records between validation and connection phases.","blast_radius":"Affects repository migrations in Gitea instances that allow external repository imports, potentially exposing internal repositories to attackers who control DNS for migration destinations.","remediation":"Upgrade to Gitea version 2.590 or later to receive the fix for CVE-2026-70357.","detection":"Monitor for unusual repository migration activity, particularly migrations targeting external hosts that are not in the configured allow list, and check for Git subprocess connections to internal addresses that would normally be blocked.","tags":["git","network","misconfiguration","rebinding"],"model":"garnet-coder","analyzedAt":"2026-10-15T09:04:34.134Z"}}