Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Gitea | Gitea | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Tue, 06 Oct 2026 19:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | With `[migrations] ALLOWED_DOMAINS` set to a matching entry such as `*` or a hostname wildcard, Gitea's migration URL validation could permit reserved and link-local addresses, such as `169.254.169.254`, even when `ALLOW_LOCALNETWORKS = false`. The local-network block list did not cover these ranges, and a hostname matching the allow list was accepted regardless of its resolved address. A user who can start migrations on such an instance could reach these addresses from the Gitea server; the default empty `ALLOWED_DOMAINS` configuration is not affected. | |
| Title | Gitea migration SSRF to reserved addresses through ALLOWED_DOMAINS | |
| Weaknesses | CWE-918 | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: Gitea
Published:
Updated: 2026-10-06T19:25:23.261Z
Reserved: 2026-10-04T21:59:53.556Z
Link: CVE-2026-96400
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-06T20:17:35.387
Modified: 2026-10-06T20:17:35.387
Link: CVE-2026-96400
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-918
Server-Side Request Forgery (SSRF)