CVE-2026-22874: Gitea webhook and migration allow-list filtering permits SSRF

Synopsis

This is a server-side request forgery (SSRF) vulnerability in Gitea's Open Source Git Server, affecting all versions up to and including 1.26.2. The flaw exists in the webhook and migration allow-list filtering logic, which can be bypassed by a network-accessible attacker holding any valid Gitea account. Successful exploitation lets the attacker force the Gitea server to make arbitrary outbound HTTP requests, reading internal services and modifying data reachable from the server's network position. HarborGuard is tracking this advisory for patch availability and will make a patched-image rebuild available the moment Gitea publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the Gitea service over the network; the vulnerability is remotely exploitable via standard HTTP/HTTPS access to the Gitea instance.

• AuthenticationRequired

  Any low-privilege Gitea account is sufficient; the attacker does not need administrative or elevated permissions.

• Victim interactionNot required

  No action from another user or administrator is needed; the attacker can trigger the SSRF entirely through their own authenticated requests.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, memory layout dependencies, or special environmental factors need to be arranged.

Blast Radius

• The attacker can instruct the Gitea server to issue HTTP requests to internal network endpoints, exposing metadata services, internal APIs, and other services not intended to be reachable from outside the host network.
• Internal service responses are returned through Gitea, allowing the attacker to read credentials, tokens, configuration data, and other sensitive information held by adjacent internal systems.
• The attacker can send authenticated requests to internal services that accept writes, modifying configuration, creating resources, or triggering actions on systems that trust traffic originating from the Gitea host.
• Because the scope is changed (S:C in the CVSS vector), impact extends beyond the Gitea application itself to any internal system the server can reach.