CVE-2026-101027

Summary

A Gitea instance configured with ALLOWED_DOMAINS for migrations can be tricked into migrating to internal services by using DNS hijacking to point allowed hostnames to loopback or private IP addresses, bypassing local network restrictions. This allows attackers to access internal services that should normally be unreachable from the external migration endpoint.

Exploitability

Exploitation requires a user with repository migration privileges who can control DNS for an allowed hostname, making it resolve to internal addresses; this is moderately difficult but possible in many environments.

Blast radius

The impact could be significant as attackers could potentially access internal services like databases, APIs, or other sensitive systems that are normally protected by local network restrictions.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Gitea version 2.590 or later to fix this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.