CVE-2026-103059

Summary

The flaw allows an attacker to exploit a case-insensitive SQL `LIKE` comparison in Gitea's SSH server, potentially matching a crafted public key to a victim's account and gaining SSH access.

Exploitability

Exploitation is moderately hard as it requires constructing a case variant of the victim's public key and having knowledge of the private key. Precondition is the `START_SSH_SERVER` must be enabled.

Blast radius

If exploited, the attacker could gain full SSH access to the victim's account, potentially leading to data theft or system compromise.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable the built-in SSH server by setting `START_SSH_SERVER = false` in the Gitea configuration.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.