CVE-2026-70357

Summary

Gitea's repository migration feature fails to protect against DNS rebinding attacks where an attacker can manipulate DNS resolution between hostname validation and actual Git connection, potentially allowing access to internally blocked repositories. This creates a window where validated external hostnames can be redirected to internal addresses that would otherwise be blocked.

Exploitability

Moderately difficult to exploit as it requires controlling DNS for the destination hostname during migration, but attackers can leverage this to bypass network allow/block lists by changing DNS records between validation and connection phases.

Blast radius

Affects repository migrations in Gitea instances that allow external repository imports, potentially exposing internal repositories to attackers who control DNS for migration destinations.

Detection

Monitor for unusual repository migration activity, particularly migrations targeting external hosts that are not in the configured allow list, and check for Git subprocess connections to internal addresses that would normally be blocked.

Prioritized remediation

Upgrade to Gitea version 2.590 or later to receive the fix for CVE-2026-70357.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.