CVE-2026-89430

Summary

Gitea allows administrators to set up push mirrors that initially validate remote addresses against allow/block lists, but subsequent synchronizations use the stored address without re-validation, potentially allowing pushes to internal/protected Git services. This creates a privilege escalation vector where users can force-push repository contents to arbitrary internal repositories.

Exploitability

Moderately difficult to exploit; requires an administrator-level account with repository push mirror configuration access, and the ability to configure a mirror that initially passes validation but later resolves to a blocked address.

Blast radius

Affects all Gitea instances where administrators can configure push mirrors, potentially allowing attackers to overwrite internal repositories with malicious content or gain persistence through forced pushes to critical internal Git services.

Detection

Monitor for repository push mirror configuration changes in Gitea logs, specifically looking for 'mirror' or 'push' operations that modify mirror URLs without re-validation against migration allow/block lists. No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Gitea 2.590 or later to receive the fix for CVE-2026-89430.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.