Soft Serve is vulnerable to SSRF through its Webhooks
Priority HIGH 72CWE-918Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
Soft Serve is a self-hostable Git server for the command line. Versions prior to 0.11.1 have a SSRF vulnerability where webhook URLs are not validated, allowing repository administrators to create webhooks targeting internal services, private networks, and cloud metadata endpoints. Version 0.11.1 fixes the vulnerability.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00368 30th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed soft-serve (charmbracelet): 0.11.1github.com/charmbracelet/soft-serve (Go): 0.11.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| charmbracelet | soft-serve | before 0.11.1 | 0.11.1 | Patch available | CNA |
| — | github.com/charmbracelet/soft-serve (Go) | before 0.11.1 | 0.11.1 | Patch available | GHSA-vwq2-jx9q-9h9f |
- soft-serve Vendorcharmbracelet Affected before 0.11.1 Fixed in 0.11.1 Patch available CNA
- github.com/charmbracelet/soft-serve (Go) Vendor— Affected before 0.11.1 Fixed in 0.11.1 Patch available GHSA-vwq2-jx9q-9h9f
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:charm:soft_serve:*:*:*:*:*:go:*:* | before 0.11.1 | Vulnerable | charmbracelet |
- cpe:2.3:a:charm:soft_serve:*:*:*:*:*:go:*:* Versions before 0.11.1 Vulnerable ·charmbracelet
Remediation
- Fix · CNA soft-serve (charmbracelet) Fixed in 0.11.1
- Fix · GHSA-vwq2-jx9q-9h9f github.com/charmbracelet/soft-serve (Go) Fixed in 0.11.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-64522
- 2026-10-03 Alias added: GHSA-vwq2-jx9q-9h9f
References
More charmbracelet Soft Serve vulnerabilities
- TI-2026-23661 Soft Serve: SSRF via unvalidated LFS endpoint in repo import CVSS 3.1CRITICAL 9.1
- TI-2023-23497 Soft Serve Public Key Authentication Bypass Vulnerability when Keyboard-Interactive SSH Authentication is Enabled CVSS 3.1HIGH 7.5
- TI-2026-25759 Soft Serve: Authenticated repo import can clone server-local private repositories CVSS 4.0HIGH 7.1
- TI-2026-17863 Soft Serve is missing an authorization check in LFS lock deletion CVSS 3.1MEDIUM 5.4
- TI-2026-19385 Soft Serve has Critical Authentication Bypass CVSS 4.0HIGH 8.1
- TI-2025-16079 Soft Serve allows path traversal attacks CVSS 4.0MEDIUM 5.3
Sources
- CVE-2025-64522 · CVE Program
- CVE-2025-64522 · NVD
- FIRST EPSS
- GHSA-vwq2-jx9q-9h9f · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences