CVE-2026-104636

Summary

Gitea's Git client validates initial remote URLs but fails to revalidate destinations after HTTP redirects, allowing attackers to bypass outbound host policies and redirect requests to otherwise blocked internal services. This creates a potential vector for unauthorized access to internal systems through repository configuration.

Exploitability

Exploitation requires a repository administrator to configure a policy-allowed endpoint that redirects to a blocked destination, making it moderately difficult but possible with proper social engineering or misconfigured policies.

Blast radius

The impact varies by configured policy but could allow access to internal services reachable from the Gitea server, potentially exposing sensitive data or systems behind firewalls.

Detection

Monitor Git operation logs for unexpected redirect patterns in outbound HTTP requests, particularly when push mirrors, wiki remote checks, or pull request fetches are performed, looking for connections to non-policy-allowed endpoints that should have been blocked.

Prioritized remediation

Upgrade to Gitea version 2.590 or later to receive the fix for CVE-2026-104636.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.