CVE-2026-101029

Executive Summary

CVE-2026-101029 is a server-side request forgery (SSRF) weakness in Gitea's repository migration and pull mirror features. Egress validation checks resolve a hostname and validate one returned address, but Git later connects to a possibly different address when the hostname returns multiple DNS answers — a classic DNS-rebinding / TOCTOU validation gap. A low-privileged authenticated user permitted to create migrations or mirrors can force the Gitea server to reach internal Git or HTTP services, read from and write to them, and exfiltrate internal response content through migration and mirror error messages. No CVSS score is assigned by NVD at this time, no patch has been published by any tracked source, and no public proof-of-concept or exploit code exists. The flaw maps to CWE-209 (Generation of Error Message Containing Sensitive Information) because internal response data can leak through error output.

Technical Analysis

The vulnerable functionality sits in Gitea's repository migration and pull mirror subsystems. These features are designed to fetch content from remote Git or HTTP endpoints on behalf of a user — for example, importing an external repository or keeping a local mirror synchronized with an upstream. Because the server itself performs the outbound request, these features are inherently SSRF-prone and are expected to be protected by egress controls that block requests to private, loopback, link-local, and otherwise internal address ranges.

The reported weakness is in how those egress checks are applied. The validation step resolves the supplied hostname and checks the resulting address against a blocklist (or equivalent allow/deny logic). The subsequent Git connection — performed later in the request lifecycle — resolves the same hostname again and may receive a different answer. When a hostname is configured to return multiple DNS A/AAAA records (multi-answer DNS), the address that passed validation is not necessarily the address the Git client ultimately connects to. This is a time-of-check/time-of-use (TOCTOU) and classic DNS-rebinding style bypass.

Two properties combine to make this exploitable:

1. Validation/connection address mismatch. The checked IP and the connected IP can differ when multiple records are returned or when DNS answers change between the two lookups. No connection is pinned to the validated address.
2. Multi-answer DNS control. An attacker who controls an authoritative DNS zone, or who can otherwise influence DNS responses, can arrange for validation to see a benign public address while the actual Git connection lands on an internal address.

The attack surface is the set of HTTP endpoints that create repository migrations and pull mirrors. Exploitation requires only a low-privileged account with permission to create a migration or a mirror; no administrative privilege is implied by the description. Internally reachable services can include internal Git servers and internal HTTP endpoints.

The CWE classification (CWE-209) reflects a secondary disclosure channel: content returned by internal services can be reflected back to the attacker through migration and mirror error messages when the fetch fails or produces an error. This turns a blind SSRF into a semi-blind one, where internal response bodies or fragments may be observable in error output, enabling internal reconnaissance and potentially exposure of internal data.

No CVSS vector is published; no specific affected version range, patch commit, function name, class name, or endpoint path is provided in the source data. The analysis above is limited to the mechanism described in the NVD description and does not assume specific code identifiers.

Exploitation Scenarios

No public proof-of-concept is available; the attack chain below is inferred at the vulnerability-class level from the NVD description.

1. Reconnaissance / target identification. The attacker identifies a Gitea instance where they hold a low-privileged account that is permitted to create repository migrations or pull mirrors. They confirm the instance is reachable and that the migration/mirror UI or API is enabled for their account level.

2. DNS and address preparation. The attacker controls, or can influence, a hostname that returns multiple DNS answers. They configure the authoritative zone so that the name resolves to a benign, validation-passing public address at the moment the egress check runs, while also returning (or later serving) an internal address that the Gitea server can reach. The objective is to exploit the gap between the validated address and the address Git later connects to.

3. Triggering the flaw. The attacker initiates a repository migration or configures a pull mirror pointing at the controlled hostname. During the request, Gitea performs its egress validation against the hostname. Because validation is not pinned to the address actually used for the outbound Git connection, the Git client subsequently connects to the internal address rather than to the validated one. This is the core bypass of the egress check.

4. Post-exploitation impact. The Git connection reaches internal services. Per the description, the attacker can read from and write to reachable internal Git or HTTP endpoints. Content from internal responses can additionally be disclosed to the attacker through migration and mirror error messages, converting the SSRF into an information-disclosure channel. Writing to internal endpoints could allow repository poisoning, configuration tampering on reachable internal services, or interaction with internal APIs that accept Git-over-HTTP or plain HTTP requests.

Because no PoC, exploit code, or Nuclei template is available, no specific payload, header, parameter, or reproducible request is provided. The steps are described at the class level only.

Impact Assessment

No CVSS score or subscores are assigned by NVD for this CVE, so impact is assessed qualitatively from the description.

• Confidentiality: High potential impact. The SSRF allows the Gitea server to query internal Git and HTTP endpoints, and internal response content can leak through error messages. This exposes internal services, their content, and potentially credentials or data returned by those internal endpoints.
• Integrity: Moderate-to-high potential impact. The description explicitly states the attacker can read from and write to reachable internal Git or HTTP endpoints, meaning internal state (repositories, data behind internal HTTP APIs) may be modified.
• Availability: Not described as a denial-of-service issue; no availability impact is implied.
• Privileges required: Low — the attacker needs only an account that can create migrations or mirrors.
• Attack vector: Network — the vulnerable functionality is exposed over Gitea's normal web/API surface.
• Blast radius: Any Gitea deployment exposed to untrusted or low-privileged users (public instances, multi-tenant deployments, internal instances with broad low-privilege account provisioning) and with reachable internal Git/HTTP services behind the same network boundary.

Business impact includes potential exposure of internal source code and internal-only HTTP services, tampering with internal repositories or services, and use of the Gitea server as a pivot for further internal enumeration. Because error-message disclosure is part of the flaw (CWE-209), even failed fetches can be used to map internal networks and extract internal response content.

Detection Guidance

Sigma Rule

title: Gitea Migration or Pull Mirror Egress-Check Bypass Attempt (SSRF)
id: 8f2c1a94-3b6d-4e21-9c77-0a5e6d9f2b13
status: experimental
description: Detects Gitea repository migration or pull mirror creation against external hosts, indicating potential exploitation of the DNS multi-answer egress-check bypass (CVE-2026-101029).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-101029
author: valtersit.com
date: 2026/01/01
logsource:
  product: gitea
  service: audit
detection:
  selection_action:
    action|contains:
      - 'repo.migrate'
      - 'repo.mirror'
      - 'mirror'
  selection_target:
    - 'target_url|contains': '://'
  condition: selection_action and selection_target
fields:
  - actor
  - action
  - target_url
  - ip
level: medium
tags:
  - attack.t1190
  - cve.2026.101029

YARA Rule

rule CVE_2026_101029_Gitea_SSRF_Migration
{
    meta:
        description = "Detects Gitea migration/mirror SSRF exploitation attempts referencing multi-answer hostnames in application logs"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-101029"
        date = "2026-01-01"
        severity = "medium"
    strings:
        $a = "migrate" nocase
        $b = "mirror" nocase
        $c = "remote_address" nocase
        $d = "dial tcp" nocase
        $e = "no such host" nocase
        $f = "connection refused" nocase
    condition:
        (uint16(0) == 0x0a0d or true) and
        (($a or $b) and ($c or $d or $e or $f))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-101029 Gitea migration/mirror creation attempt (possible SSRF egress bypass)"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/api/v1/repos/migrate"; http.request_body; content:"mirror"; nocase; http.request_body; content:"clone_addr"; nocase; classtype:attempted-recon; sid:2026101029; rev:1; reference:cve,2026-101029;)

Note: While no patch defines a redirect or specific param, Gitea's migration API is the primary touchpoint.

Elastic Detection

sequence by user.name with maxspan=5m
  [ any where event.category == "authentication" and event.outcome == "success" ]
  [ any where event.category == "web" and url.path : ("*/repos/migrate*" or "*/settings*") and http.request.method == "POST" ]

Splunk SPL Query

index=gitea sourcetype=gitea:*
| search ("migrate" OR "mirror" OR "remote_address")
| rex field=_raw "(?i)(?<target>clone_addr|mirror_url)=?(?<url>https?://\S+)"
| where isnotnull(url)
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, user, url
| where count >= 1
| sort - count

Wazuh OSSEC Rule

<group name="gitea,cve-2026-101029,">
  <rule id="101029" level="10">
    <decoded_as>json</decoded_as>
    <field name="action">migrate|mirror</field>
    <description>CVE-2026-101029: Possible Gitea migration/mirror SSRF egress-check bypass</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version list is available in the provided data.

1. Immediate mitigations (compensating controls).

   • Enforce network-layer egress filtering so the Gitea host cannot reach internal RFC1918, loopback, link-local, or metadata address ranges, regardless of application-level checks. This neutralizes the address-mismatch weakness by removing reachability to internal targets.
   • Disable repository migration and pull mirror features for low-privileged users, and restrict them to trusted administrators where operationally possible. If the feature cannot be disabled, restrict it to a small, vetted set of accounts.
   • Apply DNS and resolve-time hardening at the host level (e.g., a resolver or egress proxy that pins connections to a single validated address), so validation and connection use the same resolved address.
   • Route outbound Git/HTTP fetches through a dedicated forward proxy that independently enforces destination allowlists, rather than allowing the Gitea process to connect directly.
   • Harden error handling where possible at the deployment/integration layer (e.g., proxy or reverse-proxy log scrubbing) to limit leakage of internal response content through error messages, though the primary fix must be at the application level.

2. Patch / upgrade steps.

   • No patch is currently available from any tracked source. Monitor the Gitea project's release notes, security advisories, and the NVD entry for CVE-2026-101029 for an official fix.
   • Once a fix is published, apply it promptly and verify that the egress validation is pinned to the actual connection address (i.e., the resolved address used by the fetch is the address that was validated).

3. Long-term hardening.

   • Treat all user-supplied remote URLs as untrusted input and re-validate at connection time, not only at submission time.
   • Adopt connection pinning: resolve once, validate, and connect to the validated IP (with correct TLS SNI/Host handling) rather than re-resolving at connection time.
   • Deploy comprehensive egress monitoring and alerting for the Gitea host, focusing on connections to internal address space.
   • Review and minimize the privilege required to create migrations and mirrors in your environment.

References

• NVD — CVE-2026-101029: https://nvd.nist.gov/vuln/detail/CVE-2026-101029
• MITRE CWE-209 (Generation of Error Message Containing Sensitive Information): https://cwe.mitre.org/data/definitions/209.html
• MITRE ATT&CK T1190 (Exploit Public-Facing Application): https://attack.mitre.org/techniques/T1190/
• Gitea project security advisories and release notes (monitor for an official fix; no advisory identified in the provided data): https://github.com/go-gitea/gitea/security/advisories
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-101029 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or exploit-in-the-wild evidence were identified in the provided data. No PoC, exploit code, or Nuclei template is available.