CVE-2026-24058

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24058", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-20T22:30:11.779Z", "datePublished": "2026-01-22T22:01:22.276Z", "dateUpdated": "2026-01-23T20:14:08.759Z"}, "containers": {"cna": {"title": "Soft Serve has Critical Authentication Bypass", "problemTypes": [{"descriptions": [{"cweId": "CWE-289", "lang": "en", "description": "CWE-289: Authentication Bypass by Alternate Name", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U", "version": "4.0"}}], "references": [{"name": "https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-pchf-49fh-w34r", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-pchf-49fh-w34r"}, {"name": "https://github.com/charmbracelet/soft-serve/commit/8539f9ad39918b67d612a35785a2b4326efc8741", "tags": ["x_refsource_MISC"], "url": "https://github.com/charmbracelet/soft-serve/commit/8539f9ad39918b67d612a35785a2b4326efc8741"}, {"name": "https://github.com/charmbracelet/soft-serve/releases/tag/v0.11.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/charmbracelet/soft-serve/releases/tag/v0.11.3"}], "affected": [{"vendor": "charmbracelet", "product": "soft-serve", "versions": [{"version": "< 0.11.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-22T22:01:22.276Z"}, "descriptions": [{"lang": "en", "value": "Soft Serve is a self-hostable Git server for the command line. Versions 0.11.2 and below have a critical authentication bypass vulnerability that allows an attacker to impersonate any user (including admin) by \"offering\" the victim's public key during the SSH handshake before authenticating with their own valid key. This occurs because the user identity is stored in the session context during the \"offer\" phase and is not cleared if that specific authentication attempt fails. This issue has been fixed in version 0.11.3."}], "source": {"advisory": "GHSA-pchf-49fh-w34r", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-23T20:13:58.882762Z", "id": "CVE-2026-24058", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-23T20:14:08.759Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24058", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-23T20:13:58.882762Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-23T20:14:04.769Z"}}], "cna": {"title": "Soft Serve has Critical Authentication Bypass", "source": {"advisory": "GHSA-pchf-49fh-w34r", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "charmbracelet", "product": "soft-serve", "versions": [{"status": "affected", "version": "< 0.11.3"}]}], "references": [{"url": "https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-pchf-49fh-w34r", "name": "https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-pchf-49fh-w34r", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/charmbracelet/soft-serve/commit/8539f9ad39918b67d612a35785a2b4326efc8741", "name": "https://github.com/charmbracelet/soft-serve/commit/8539f9ad39918b67d612a35785a2b4326efc8741", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/charmbracelet/soft-serve/releases/tag/v0.11.3", "name": "https://github.com/charmbracelet/soft-serve/releases/tag/v0.11.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Soft Serve is a self-hostable Git server for the command line. Versions 0.11.2 and below have a critical authentication bypass vulnerability that allows an attacker to impersonate any user (including admin) by \"offering\" the victim's public key during the SSH handshake before authenticating with their own valid key. This occurs because the user identity is stored in the session context during the \"offer\" phase and is not cleared if that specific authentication attempt fails. This issue has been fixed in version 0.11.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-289", "description": "CWE-289: Authentication Bypass by Alternate Name"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-22T22:01:22.276Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24058", "state": "PUBLISHED", "dateUpdated": "2026-01-23T20:14:08.759Z", "dateReserved": "2026-01-20T22:30:11.779Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-22T22:01:22.276Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "soft-serve", "vendor": "charmbracelet", "versions": [{"status": "affected", "version": "< 0.11.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:charm:soft_serve:*:*:*:*:*:go:*:*", "matchCriteriaId": "EE609E86-02D8-4580-9122-048301D83CFB", "versionEndExcluding": "0.11.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Soft Serve is a self-hostable Git server for the command line. Versions 0.11.2 and below have a critical authentication bypass vulnerability that allows an attacker to impersonate any user (including admin) by \"offering\" the victim's public key during the SSH handshake before authenticating with their own valid key. This occurs because the user identity is stored in the session context during the \"offer\" phase and is not cleared if that specific authentication attempt fails. This issue has been fixed in version 0.11.3."}, {"lang": "es", "value": "Soft Serve es un servidor Git autoalojable para la l\u00ednea de comandos. Las versiones 0.11.2 e inferiores tienen una vulnerabilidad cr\u00edtica de omisi\u00f3n de autenticaci\u00f3n que permite a un atacante suplantar a cualquier usuario (incluido el administrador) al 'ofrecer' la clave p\u00fablica de la v\u00edctima durante el handshake SSH antes de autenticarse con su propia clave v\u00e1lida. Esto ocurre porque la identidad del usuario se almacena en el contexto de la sesi\u00f3n durante la fase de 'oferta' y no se borra si ese intento de autenticaci\u00f3n espec\u00edfico falla. Este problema ha sido solucionado en la versi\u00f3n 0.11.3."}], "id": "CVE-2026-24058", "lastModified": "2026-06-17T10:22:32.197", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24058", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-23T20:13:58.882762Z", "version": "2.0.3"}}]}, "published": "2026-01-22T22:16:21.387", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/charmbracelet/soft-serve/commit/8539f9ad39918b67d612a35785a2b4326efc8741"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/charmbracelet/soft-serve/releases/tag/v0.11.3"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-pchf-49fh-w34r"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-289"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T03:34:20.829647+00:00", "value": {"mitigation_remediation": ["Upgrade the Soft Serve server to version 0.11.3 or later to remove the authentication bypass flaw.", "Re\u2011validate that no older instances or containers of Soft Serve remain in the deployment environment and that the upgraded binary is in use.", "If a full upgrade cannot be performed immediately, restrict external SSH access to the server and monitor login attempts for anomalous key offers to detect potential exploitation attempts."], "summary": {"action": "Patch", "impact": "Authentication Bypass"}, "threat_synthesis": {"affected_systems": "Charmbracelet Soft Serve versions 0.11.2 and earlier are affected. The product is the self\u2011hostable Git server for the command line, running on any system where Soft Serve 0.11.2 or older is installed. The fix was released in version 0.11.3 and applies to all supported platforms, including containers and binary packages.", "description_and_impact": "The vulnerability is a critical authentication bypass that allows an attacker to impersonate any user, including the administrator, by offering the victim\u2019s public key during the SSH handshake before authenticating with their own valid key. This flaw arises because the user identity is stored in the session context during the offer phase and is not cleared if that particular authentication attempt fails. As a result, an unauthenticated attacker can exploit the session to perform actions as the targeted user, potentially compromising all privileged operations and data within the server.", "risk_and_exploitability": "The CVSS score of 8.1 indicates high severity, but the EPSS score of less than 1% suggests exploitation is currently unlikely under typical circumstances. The vulnerability is not listed in the CISA KEV catalog, further implying limited reported use. Attackers would need network access to the Soft Serve instance\u2019s SSH port and the ability to initiate an SSH connection. Once they provide the victim\u2019s public key, the server will associate the session with that identity despite the failed authentication attempt, enabling unauthorized operations until the session is terminated."}}}}, "created": "2026-01-23T10:27:25.775946+00:00", "updated": "2026-04-18T03:45:21.072345+00:00", "vendors": ["charmbracelet", "charmbracelet$PRODUCT$soft-serve"]}