CVE-2026-22874: Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter
Gitea’s default SSRF allow-list (MatchBuiltinExternal, used by both webhook delivery and repository migrations) relies on Go’s standard library net.IP.IsPrivate(), which only covers RFC 1918 and RFC 4193. As a result, several IP ranges commonly used for cloud metadata services, internal networks, and IPv6 transition mechanisms are not blocked, allowing authenticated users to send HTTP requests to those destinations and read the responses via the webhook history UI.
References
- blog.gitea.com/release-of-1.26.3-and-1.26.4
- github.com/advisories/GHSA-2r5c-gw76-rh3w
- github.com/go-gitea/gitea/pull/38059
- github.com/go-gitea/gitea/pull/38173
- github.com/go-gitea/gitea/releases/tag/v1.26.3
- github.com/go-gitea/gitea/security/advisories/GHSA-2r5c-gw76-rh3w
- nvd.nist.gov/vuln/detail/CVE-2026-22874
Code Behaviors & Features
Detect and mitigate CVE-2026-22874 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →