CVE-2026-103059

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-103059", "assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2", "state": "PUBLISHED", "assignerShortName": "Gitea", "dateReserved": "2026-10-04T21:57:35.559Z", "datePublished": "2026-10-06T19:22:57.192Z", "dateUpdated": "2026-10-07T14:17:20.596Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2", "shortName": "Gitea", "dateUpdated": "2026-10-06T19:22:57.192Z"}, "title": "Gitea built-in SSH server authentication bypass through key case folding", "descriptions": [{"lang": "en", "value": "When Gitea's built-in SSH server is enabled (`START_SSH_SERVER = true`), the presented public key was looked up with an SQL `LIKE` comparison of its encoded content, which is case-insensitive on some databases, including the default SQLite. An attacker who can construct a case variant of another user's registered RSA public key for which they can derive the private key could have that key matched to the victim's account and authenticate over SSH as that user. Keys are now looked up by fingerprint."}], "affected": [{"vendor": "Gitea", "product": "Gitea", "packageName": "gitea.dev", "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.27.3", "versionType": "semver"}]}], "references": [{"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-8pwg-hcgm-54cp", "name": "GitHub Security Advisory GHSA-8pwg-hcgm-54cp", "tags": ["vendor-advisory"]}, {"url": "https://github.com/go-gitea/gitea/pull/39423", "name": "Fix: go-gitea/gitea pull request #39423", "tags": ["patch"]}, {"url": "https://blog.gitea.com/release-of-28.0.0/", "name": "Gitea 28.0.0 release announcement", "tags": ["release-notes"]}, {"url": "https://github.com/go-gitea/gitea/releases/tag/v28.0.0", "name": "go-gitea/gitea v28.0.0 release", "tags": ["release-notes"]}], "credits": [{"lang": "en", "value": "https://github.com/carlini", "type": "reporter"}, {"lang": "en", "value": "https://github.com/TheFox0x7", "type": "remediation developer"}, {"lang": "en", "value": "https://github.com/wxiaoguang", "type": "remediation developer"}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-305", "lang": "en", "description": "CWE-305 Authentication Bypass by Primary Weakness"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-10-07T14:17:16.900412Z", "id": "CVE-2026-103059", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-07T14:17:20.596Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-103059", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-07T14:17:16.900412Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-305", "description": "CWE-305 Authentication Bypass by Primary Weakness"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-07T14:16:38.441Z"}}], "cna": {"title": "Gitea built-in SSH server authentication bypass through key case folding", "credits": [{"lang": "en", "type": "reporter", "value": "https://github.com/carlini"}, {"lang": "en", "type": "remediation developer", "value": "https://github.com/TheFox0x7"}, {"lang": "en", "type": "remediation developer", "value": "https://github.com/wxiaoguang"}], "affected": [{"vendor": "Gitea", "product": "Gitea", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.27.3"}], "packageName": "gitea.dev", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-8pwg-hcgm-54cp", "name": "GitHub Security Advisory GHSA-8pwg-hcgm-54cp", "tags": ["vendor-advisory"]}, {"url": "https://github.com/go-gitea/gitea/pull/39423", "name": "Fix: go-gitea/gitea pull request #39423", "tags": ["patch"]}, {"url": "https://blog.gitea.com/release-of-28.0.0/", "name": "Gitea 28.0.0 release announcement", "tags": ["release-notes"]}, {"url": "https://github.com/go-gitea/gitea/releases/tag/v28.0.0", "name": "go-gitea/gitea v28.0.0 release", "tags": ["release-notes"]}], "descriptions": [{"lang": "en", "value": "When Gitea's built-in SSH server is enabled (`START_SSH_SERVER = true`), the presented public key was looked up with an SQL `LIKE` comparison of its encoded content, which is case-insensitive on some databases, including the default SQLite. An attacker who can construct a case variant of another user's registered RSA public key for which they can derive the private key could have that key matched to the victim's account and authenticate over SSH as that user. Keys are now looked up by fingerprint."}], "providerMetadata": {"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2", "shortName": "Gitea", "dateUpdated": "2026-10-06T19:22:57.192Z"}}}, "cveMetadata": {"cveId": "CVE-2026-103059", "state": "PUBLISHED", "dateUpdated": "2026-10-07T14:17:20.596Z", "dateReserved": "2026-10-04T21:57:35.559Z", "assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2", "datePublished": "2026-10-06T19:22:57.192Z", "assignerShortName": "Gitea"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "gitea.dev", "product": "Gitea", "vendor": "Gitea", "versions": [{"lessThanOrEqual": "1.27.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "88ee5874-cf24-4952-aea0-31affedb7ff2"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*", "matchCriteriaId": "B7A6F93E-7785-4553-A8BB-DA84ACFF76F0", "versionEndExcluding": "28.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "When Gitea's built-in SSH server is enabled (`START_SSH_SERVER = true`), the presented public key was looked up with an SQL `LIKE` comparison of its encoded content, which is case-insensitive on some databases, including the default SQLite. An attacker who can construct a case variant of another user's registered RSA public key for which they can derive the private key could have that key matched to the victim's account and authenticate over SSH as that user. Keys are now looked up by fingerprint."}], "id": "CVE-2026-103059", "lastModified": "2026-10-15T02:26:26.567", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-103059", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-07T14:17:16.900412Z", "version": "2.0.3"}}]}, "published": "2026-10-06T20:17:14.377", "references": [{"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "tags": ["Release Notes"], "url": "https://blog.gitea.com/release-of-28.0.0/"}, {"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "tags": ["Patch", "Issue Tracking"], "url": "https://github.com/go-gitea/gitea/pull/39423"}, {"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "tags": ["Release Notes"], "url": "https://github.com/go-gitea/gitea/releases/tag/v28.0.0"}, {"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "tags": ["Vendor Advisory"], "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-8pwg-hcgm-54cp"}], "sourceIdentifier": "88ee5874-cf24-4952-aea0-31affedb7ff2", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-305"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "code.gitea.io/gitea: Gitea: Authentication bypass via case-insensitive SSH public key lookup", "id": "2547093", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547093"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-178", "details": ["When Gitea's built-in SSH server is enabled (`START_SSH_SERVER = true`), the presented public key was looked up with an SQL `LIKE` comparison of its encoded content, which is case-insensitive on some databases, including the default SQLite. An attacker who can construct a case variant of another user's registered RSA public key for which they can derive the private key could have that key matched to the victim's account and authenticate over SSH as that user. Keys are now looked up by fingerprint.", "A flaw was found in Gitea. When the built-in Secure Shell (SSH) server is enabled, public keys are evaluated using a case-insensitive comparison on certain database systems. A remote attacker who constructs a case variant of an existing user's registered public key and possesses the corresponding private key can authenticate as that user over SSH. This flaw allows an attacker to bypass authentication and gain unauthorized access to victim accounts."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-103059", "public_date": "2026-10-06T19:22:57Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-103059\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-103059\nhttps://blog.gitea.com/release-of-28.0.0/\nhttps://github.com/go-gitea/gitea/pull/39423\nhttps://github.com/go-gitea/gitea/releases/tag/v28.0.0\nhttps://github.com/go-gitea/gitea/security/advisories/GHSA-8pwg-hcgm-54cp"], "statement": "An IMPORTANT severity flaw was found in Gitea, which is bundled in Red Hat's Konflux pipelines-as-code controller and watcher container images. When Gitea's built-in SSH server is enabled (START_SSH_SERVER = true), the presented public key is looked up with an SQL LIKE comparison of its encoded content, which is case-insensitive on some database backends, including the default SQLite. A remote, unauthenticated attacker who can construct a case variant of another user's registered RSA public key and derive the corresponding private key can have that key matched to the victim's account and authenticate over SSH as that user. This bypasses authentication and gives the attacker unauthorized access to the victim's account, including read access to private repositories and the ability to push code with the victim's identity. Red Hat assigned this flaw a CVSS 3.1 score of 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N); the high attack complexity reflects the non-default built-in SSH server configuration, the case-insensitive database prerequisite, and the difficulty of forging a case-variant RSA key pair. This rating is lower than the CISA score of 9.1, which assumes low attack complexity. The affected Red Hat products are handled through a delegated resolution, and a fix is being pursued for the affected Konflux pipelines-as-code images. Upstream resolved the issue by looking up SSH public keys by fingerprint instead of by content comparison.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.27.3]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Gitea", "source": "cna", "vendor": "Gitea"}, "product": "gitea", "vendor": "gitea"}], "created": "2026-10-06T21:00:06.895037+00:00", "updated": "2026-10-17T08:30:05.498017+00:00", "vendors": ["gitea", "gitea$PRODUCT$gitea"]}