Read the docs
TI-2026-19385 Aliases CVE-2026-24058GHSA-pchf-49fh-w34r

Soft Serve has Critical Authentication Bypass

Priority LOW 38CWE-289Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Soft Serve is a self-hostable Git server for the command line. Versions 0.11.2 and below have a critical authentication bypass vulnerability that allows an attacker to impersonate any user (including admin) by "offering" the victim's public key during the SSH handshake before authenticating with their own valid key. This occurs because the user identity is stored in the session context during the "offer" phase and is not cleared if that specific authentication attempt fails. This issue has been fixed in version 0.11.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00578 47th percentileScored 2026-11-07
Fix Fixed soft-serve (charmbracelet): 0.11.3github.com/charmbracelet/soft-serve (Go): 0.11.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
charmbraceletsoft-servebefore 0.11.30.11.3Patch availableCNA
—github.com/charmbracelet/soft-serve (Go)before 0.11.30.11.3Patch availableGHSA-pchf-49fh-w34r
  • soft-serve Vendorcharmbracelet Affected before 0.11.3 Fixed in 0.11.3 Patch available CNA
  • github.com/charmbracelet/soft-serve (Go) Vendor— Affected before 0.11.3 Fixed in 0.11.3 Patch available GHSA-pchf-49fh-w34r

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:charm:soft_serve:*:*:*:*:*:go:*:*before 0.11.3Vulnerablecharmbracelet
  • cpe:2.3:a:charm:soft_serve:*:*:*:*:*:go:*:* Versions before 0.11.3 Vulnerable ·charmbracelet

Remediation

  • Fix · CNA soft-serve (charmbracelet) Fixed in 0.11.3
  • Fix · GHSA-pchf-49fh-w34r github.com/charmbracelet/soft-serve (Go) Fixed in 0.11.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-24058
  2. 2026-10-03 Alias added: GHSA-pchf-49fh-w34r

References

Patch 1

Advisory 2

Other 2

  • TI-2026-23661 Soft Serve: SSRF via unvalidated LFS endpoint in repo import CVSS 3.1CRITICAL 9.1
  • TI-2025-39912 Soft Serve is vulnerable to SSRF through its Webhooks CVSS 3.1CRITICAL 9.1
  • TI-2023-23497 Soft Serve Public Key Authentication Bypass Vulnerability when Keyboard-Interactive SSH Authentication is Enabled CVSS 3.1HIGH 7.5
  • TI-2026-25759 Soft Serve: Authenticated repo import can clone server-local private repositories CVSS 4.0HIGH 7.1
  • TI-2026-17863 Soft Serve is missing an authorization check in LFS lock deletion CVSS 3.1MEDIUM 5.4
  • TI-2025-16079 Soft Serve allows path traversal attacks CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences