CVE-2026-103670

Summary

A Gitea Actions concurrency cancellation flaw allows attackers to interrupt in-progress trusted runs without approval by creating pull requests from forks, potentially disrupting deployments on self-hosted runners.

Exploitability

Exploitation is moderately easy requiring only fork PR creation with a workflow that shares a concurrency group with cancel-in-progress enabled, no code execution needed.

Blast radius

The impact could be significant for self-hosted runners where interrupted runs might leave partial deployment states or cause service disruptions.

Detection

Monitor for unexpected cancellation events in workflow run logs where fork PRs are involved, particularly when concurrent runs share the same concurrency group with cancel-in-progress enabled.

Prioritized remediation

Upgrade to Gitea 2.590 or later to fix the concurrency cancellation logic.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.