CVE-2026-58426: Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write

Synopsis

This is an HMAC signature ambiguity vulnerability in the Gitea Actions Artifacts V4 signed URL implementation, affecting Gitea Open Source Git Server versions up to and including 1.26.1. An authenticated attacker with a low-privilege account can reach the affected endpoint over the network and exploit the ambiguous HMAC construction to forge valid signed URLs for other repositories or tasks. Successful exploitation gives the attacker unauthorized read access to artifacts stored in other repositories and the ability to write upload state across task boundaries, compromising both confidentiality and integrity of CI/CD artifact data. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Gitea publishes a fix version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Gitea Actions Artifacts V4 API endpoint over the network; the service must be accessible from the attacker's network location.

• AuthenticationRequired

  A low-privilege account is sufficient; the attacker must hold valid Gitea credentials but does not need administrative access.

• Victim interactionNot required

  No victim action is needed; the attacker interacts directly with the API without requiring any other user to click a link or perform an action.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special environmental conditions, race conditions, or memory layout knowledge.

Blast Radius

• Attacker reads artifact files (binaries, test results, secrets embedded in build outputs) stored in repositories they have no authorization to access.
• Attacker writes forged upload-state records across task boundaries, corrupting artifact metadata and potentially substituting malicious build outputs for legitimate ones.
• The scope change (S:C in the CVSS vector) means impact extends beyond the attacker's own repository context to other repositories and tasks hosted on the same Gitea instance.