Read the docs
TI-2026-68587 Aliases CVE-2026-103059

Authentication bypass in Gitea SSH server through key case folding

Priority MEDIUM 47CWE-305Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

Gitea through 1.27.3 is affected when its built-in SSH server is enabled. Key lookup uses a case-insensitive SQL LIKE comparison, which causes an authentication bypass (CWE-305). An unauthenticated remote attacker who can derive the private key for a case variant of another user's registered RSA public key can authenticate over SSH as that user.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

When Gitea's built-in SSH server is enabled (`START_SSH_SERVER = true`), the presented public key was looked up with an SQL `LIKE` comparison of its encoded content, which is case-insensitive on some databases, including the default SQLite. An attacker who can construct a case variant of another user's registered RSA public key for which they can derive the private key could have that key matched to the victim's account and authenticate over SSH as that user. Keys are now looked up by fingerprint.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00391 33rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GiteaGiteaup to 1.27.3—No fix listedCNA
  • Gitea VendorGitea Affected up to 1.27.3 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*before 28.0.0VulnerableGitea
  • cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:* Versions before 28.0.0 Vulnerable ·Gitea

Remediation

The sources list no fixed version for Gitea.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-06 Threatist record created from CVE-2026-103059
  2. 2026-10-07 Affected versions changed · Red Hat
  3. 2026-10-07 CVSS score added · Red Hat
  4. 2026-10-07 CVSS score added · CISA ADP
  5. 2026-10-07 Weakness changed · CISA ADP
  6. 2026-10-07 CISA SSVC decision points changed
  7. 2026-10-07 Priority changed: LOW → MEDIUM

References

Patch 1

Advisory 1

Other 2

  • TI-2026-42785 Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation. KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-11072 The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote… CVSS 3.1HIGH 7.2
  • TI-2022-12910 Gitea before 1.16.7 does not escape git fetch remote. CVSS 3.1HIGH 7.5
  • TI-2019-08404 models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror… CVSS 3.1HIGH 8.8
  • TI-2022-00955 Open Redirect on login in go-gitea/gitea CVSS 3.1MEDIUM 6.1
  • TI-2026-68968 Push-to-create bypass of FORCE_PRIVATE policy in Gitea CVSS 3.1MEDIUM 5.4
See all 80 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences