CVE-2026-109553

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-109553
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109553.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-109553
Aliases
  • GHSA-vcp6-2qc6-gvq3
Published
2026-10-18T18:51:31Z
Modified
2026-10-19T10:45:12Z
Summary
Gitea SSH certificate principal impersonation of other users
Details

Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. When Gitea trusts a user certificate authority (SSH_TRUSTED_USER_CA_KEYS) and accepts arbitrary principals (SSH_AUTHORIZED_PRINCIPALS_ALLOW=anything), a user could register another user's public key line as their own principal, or a holder of a certificate signed by that authority could list it, and then authenticate as the owner of that key through the HTTP signature API and the built-in SSH server. Instances that do not trust a user certificate authority are not affected.

Database specific 
{
    "cna_assigner":  "Gitea",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109553.json"
}
References

Affected packages

Git / github.com/go-gitea/gitea

Affected ranges

Type
GIT
Repo
https://github.com/go-gitea/gitea
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
4ebd5e319b6a9e629bfd7a04292a6fe85b08dee9
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "28.1.0"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

v0.*
v0.9.99
v1.*
v1.0.0
v1.1.0
v1.10.0-dev
v1.10.0-rc1
v1.10.5
v1.11.0-dev
v1.11.0-rc1
v1.12.0-dev
v1.13.0-dev
v1.14.0-dev
v1.15.0-dev
v1.15.0-rc1
v1.16.0-dev
v1.16.0-rc1
v1.17.0-dev
v1.18.0-dev
v1.18.0-rc0
v1.19.0-dev
v1.19.0-rc0
v1.20.0-dev
v1.20.0-rc0
v1.21.0-dev
v1.21.0-rc0
v1.22.0-dev
v1.22.0-rc0
v1.22.0-rc1
v1.23.0-dev
v1.24.0-dev
v1.25.0-dev
v1.26.0-dev
v1.27.0-dev
v1.28.0-dev
v1.5.0-dev
v1.5.0-rc1
v1.6.0-dev
v1.6.0-rc1
v1.7.0-dev
v1.9.0-dev
v1.9.0-rc1
v28.*
v28.0.0
v28.1.0
v29.*
v29.0.0-dev

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109553.json"