CVE-2026-58423: Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories
A flaw in SSH LFS sub-verb handling allows any authenticated SSH user to obtain valid LFS credentials for any repository on the instance, including private repositories they have no access to. This enables unauthorized download of all LFS objects from any private repository.
References
- blog.gitea.com/release-of-1.26.3-and-1.26.4
- github.com/advisories/GHSA-7wvc-rvp7-w99x
- github.com/go-gitea/gitea/commit/42513398c05ca6bdf71da76cb6f9baaebe8cb924
- github.com/go-gitea/gitea/commit/8f4b7ebbf6061bd44b1ab3824f17f37b87fb1740
- github.com/go-gitea/gitea/pull/38008
- github.com/go-gitea/gitea/releases/tag/v1.26.4
- github.com/go-gitea/gitea/security/advisories/GHSA-7wvc-rvp7-w99x
- nvd.nist.gov/vuln/detail/CVE-2026-58423
Code Behaviors & Features
Detect and mitigate CVE-2026-58423 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →