Gitea Patches 27 Security Flaws, Including Critical SSH Authentication Bypass and SSRF

What happened?

Gitea has released security updates addressing 27 reported flaws across versions 28.0.0 and 28.1.0, including a critical SSH authentication bypass and server-side request forgery (SSRF) weaknesses. The fixes cover account access, repository permissions, automated workflows, and connections to internal systems. Administrators should treat the update as an urgent priority for their development infrastructure. Released on September 30, Gitea 28.0.0 lists 20 CVEs in its security notes. The reported total of 27 spans that release and the follow-up 28.1.0 update, rather than 28.0.0 alone.

Key details

• Gitea released updates fixing 27 flaws in versions 28.0.0 and 28.1.0, including critical SSH bypass and SSRF issues.
• CVE-2026-103059 is a critical SSH authentication bypass with CVSS 9.1 affecting deployments using Gitea's built-in SSH server.
• Several flaws allowed repository migrations and mirrors to bypass outbound connection rules via DNS manipulation.
• CVE-2026-101027 allowed an approved domain to skip destination IP checks, while CVE-2026-101029 used multiple DNS answers to bypass the outbound allowlist.
• CVE-2026-89430 let push mirrors connect to internal Git hosts after saved addresses passed an earlier check, potentially allowing forced pushes.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.