BIT-gitea-2026-103059

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/gitea/BIT-gitea-2026-103059.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-gitea-2026-103059
Aliases
Published
2026-10-16T08:36:29Z
Modified
2026-10-16T09:55:59Z
Summary
Gitea built-in SSH server authentication bypass through key case folding
Details

When Gitea's built-in SSH server is enabled (START_SSH_SERVER = true), the presented public key was looked up with an SQL LIKE comparison of its encoded content, which is case-insensitive on some databases, including the default SQLite. An attacker who can construct a case variant of another user's registered RSA public key for which they can derive the private key could have that key matched to the victim's account and authenticate over SSH as that user. Keys are now looked up by fingerprint.

Database specific 
{
    "cpes":  [
        "cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*"
    ],
    "severity":  "Critical"
}
References

Affected packages

Bitnami / gitea

Package

Name
gitea
Purl
pkg:bitnami/gitea

Severity

  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
28.0.0

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/gitea/BIT-gitea-2026-103059.json"