CVE-2026-104626

8.8 HIGHpublic exploit available

Published 2026-10-06 · Updated 2026-10-07

AI risk analysis

Summary: This vulnerability allows a user to execute fork-controlled workflow code by manipulating Gitea Actions runs, requiring maintainer approval to exploit fully.
Exploitability: Exploitation is moderately difficult, requiring maintainer approval, Actions to be enabled, and a runner that accepts the repository's jobs.
Blast radius: If exploited, the impact is high, as it can lead to execution of arbitrary code in the context of the repository.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Disable Gitea Actions for the affected repositories or restrict access to the Actions feature.

rcewebgitcode-execution

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

A user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a Gitea Actions run that is awaiting approval. When a later run in that group cancels the blocked job, the run becomes terminal while still marked as needing approval. If a maintainer later approves the run, Gitea passed the already-cancelled job back through concurrency preparation, set it to waiting, and made it claimable by a matching runner, executing fork-controlled workflow code. Exploitation requires the maintainer's later approval action, Actions to be enabled, and a runner that accepts the repository's jobs.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-841

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.