CVE-2026-103059

Executive Summary

CVE-2026-103059 is an improper authentication vulnerability in Gitea's built-in SSH server. When START_SSH_SERVER = true, the server resolved a presented public key against stored keys using an SQL LIKE comparison of the key's encoded content, which is case-insensitive on some database backends (including the default SQLite). An attacker who can construct a case variant of another user's registered RSA public key and derive the corresponding private key could have that key matched to the victim's account and authenticate over SSH as that user.

Technical Analysis

Gitea supports an optional built-in SSH server enabled via the START_SSH_SERVER = true configuration flag. In the vulnerable implementation, when a client presents a public key during SSH authentication, the server looks up a matching registered key by comparing the encoded key content using an SQL LIKE comparison.

The core defect is the comparison semantics of the lookup, not the SSH protocol handling itself. On several database engines — notably SQLite, which is Gitea's default database — LIKE is case-insensitive for ASCII characters by default. Consequently, two encoded key strings that differ only in the case of characters present in the encoding can be treated as equal by the query. Because the public key presented in SSH authentication is attacker-controlled (the client sends whatever public key it owns), an attacker can submit a key whose encoded form is a case variant of the victim's registered key.

For passwordless SSH authentication to succeed, the attacker must also possess the private key corresponding to the presented public key. This is the critical constraint: possession of a case-variant public key alone is insufficient. The attacker must construct a public key blob that both (a) matches the victim's stored key under the case-insensitive LIKE comparison and (b) for which they can derive the matching private key. This is non-trivial for standard RSA encodings, since the encoded content (base64/algorithm identifier/modulus/exponent material) is not freely case-choosable without altering the underlying cryptographic parameters — creating a deliberate asymmetry that raises exploitation complexity.

Two conditions therefore bound the attack surface:

1. Gitea must be configured with the built-in SSH server (START_SSH_SERVER = true) rather than delegating SSH to an external daemon.
2. The backing database must perform case-insensitive matching for the LIKE operator — SQLite (the default) qualifies.

The fix is architectural: key lookup was changed to use fingerprint-based matching instead of encoding-content matching. Fingerprints are cryptographic, exact-match identifiers, eliminating the case-sensitivity ambiguity entirely.

Exploitation Scenarios

This vulnerability belongs to the improper-authentication / username-enumeration-and-impersonation class. No public PoC is available; the attack chain is inferred from the vulnerability class and the NVD description.

1. Reconnaissance / target identification. The attacker identifies a Gitea instance exposing the built-in SSH server (START_SSH_SERVER = true on the SSH port, frequently 22 or a custom port) and, critically, must learn the target account's registered RSA public key content. Public SSH keys are frequently exposed through user profile pages, commit/author metadata, API responses, mirrors, or cloned repository metadata. The attacker also determines that the backing store is case-insensitive on LIKE (consistent with the default SQLite backend, though this is not directly observable pre-attack).

2. Triggering the flaw class. The attacker crafts or obtains a public key whose encoded content is a case variant of the victim's registered key — i.e., differing only in the case of characters that the case-insensitive database comparison ignores. The crux is the requirement in the advisory: the attacker must be able to derive the private key corresponding to the case-variant public key they present. Only if that cryptographic condition is satisfiable does the presented key fail the server's identity binding while still passing SSH proof-of-private-key-possession.

3. Execution method (vulnerability-class level). The attacker initiates an SSH authentication attempt against the Gitea SSH server, presenting the case-variant public key. The server performs the LIKE-based lookup, which — under case-insensitive semantics — matches the variant against the victim's stored key, resolving the request to the victim's account. Because the attacker holds the corresponding private key, the SSH authentication handshake completes successfully as the victim.

4. Post-exploitation impact. A successful match results in authentication as the victim user. Depending on the victim's privileges, this grants unauthorized access to the victim's repositories, the ability to read and push code, inspect private resources, and potentially leverage the account for lateral movement within the Gitea organization. The advisory does not describe further server-level command execution; the demonstrated impact is account impersonation.

Impact Assessment

Scope and blast radius are governed by the identity of the impersonated account. An attacker who successfully matches a high-privilege maintainer or administrator key could obtain broad access to source code, private repositories, organizational settings, and potentially deploy or CI/CD resources reachable through that account. For standard developer accounts, the impact is unauthorized repository access and code integrity exposure.

CVSS subscores are estimated as follows (no vendor vector provided): Network attack vector (AV:N, SSH is remotely reachable), High attack complexity (AC:H, gated on the requirement to derive a private key for a case-variant of the victim's public key), No privileges required (PR:N), No user interaction (UI:N), High confidentiality and integrity impact (C:H/I:H) if impersonation succeeds, and No availability impact (A:N). The High attack complexity reflects the non-trivial cryptographic precondition that materially limits practical exploitation. Availability is unaffected, so the estimated vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N.

Note: FIRST.org has not yet scored this CVE for EPSS, and CISA KEV does not list it.

Detection Guidance

Sigma Rule

title: Gitea Built-in SSH Server Authentication as Another User via Key Lookup Abuse
id: 8f3c1a72-9d54-4b21-b6a0-cve2026103059
status: experimental
description: Detects suspicious Gitea SSH authentication activity relevant to CVE-2026-103059, where a presented public key is matched to another user's account via case-insensitive lookup.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-103059
author: valtersit.com
logsource:
  product: gitea
  service: ssh
detection:
  selection_event:
    event|contains:
      - 'SSH'
      - 'publickey'
  selection_auth:
    action: 'login'
    method: 'publickey'
  selection_anomaly:
    message|contains|all:
      - 'publickey'
    message|contains:
      - 'case'
  condition: selection_event and selection_auth
falsepositives:
  - Legitimate SSH public key authentication by the key owner
level: medium
tags:
  - attack.initial_access
  - attack.t1078

YARA Rule

rule CVE_2026_103059_Gitea_SSH_Key_Lookup
{
    meta:
        description = "Detects Gitea configurations susceptible to CVE-2026-103059 (built-in SSH server with encoded-key LIKE lookup)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-103059"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $ssh_on  = "START_SSH_SERVER = true"
        $ssh_on2 = "START_SSH_SERVER=true"
        $gitea   = "Gitea"
        $cfg     = "[server]"

    condition:
        2 of ($ssh_*) and ($gitea or $cfg)
}

Suricata IDS Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 22 (msg:"CVE-2026-103059 Gitea built-in SSH possible impersonation via publickey authentication"; flow:to_server,established; content:"SSH-"; depth:4; content:"publickey"; nocase; threshold: type limit, track by_src, count 1, seconds 60; classtype:attempted-user; reference:cve,2026-103059; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-103059; sid:2026103059; rev:1;)

Elastic Detection

event.category: "authentication" and
event.outcome: "success" and
process.name: "gitea" and
event.action: "publickey" and
network.transport: "tcp"

Splunk SPL Query

index=gitea OR index=linux sourcetype=gitea:server OR sourcetype=sshd
| search "START_SSH_SERVER" OR "publickey" OR "public key"
| where match(_raw, "(?i)publickey") AND match(_raw, "(?i)gitea")
| stats count min(_time) as first_seen max(_time) as last_seen by host, user, src_ip
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="gitea,ssh,">
  <rule id="2026103" level="10">
    <decoded_as>gitea</decoded_as>
    <match>publickey</match>
    <description>CVE-2026-103059: Gitea SSH public key authentication event - possible impersonation via case-insensitive key lookup</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>authentication_success,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations.

   • Update Gitea to a version containing the upstream change that resolves SSH keys by fingerprint rather than by an SQL LIKE comparison of encoded content. Because no CVE-specific patched version is identified in tracked sources, verify the fingerprint-based lookup fix has been applied to your deployment before considering the issue closed.
   • Where the built-in SSH server is not required, set START_SSH_SERVER = false and delegate SSH to an external, dedicated SSH daemon that performs exact-match key authorization.
   • Reduce the exposure of registered public keys where possible (trim key material from public profiles and metadata) to lower the reconnaissance prerequisite.
   • If a database backend other than SQLite is in use, confirm whether its LIKE operator is case-sensitive; a case-sensitive backend materially reduces the practical exposure of the vulnerable lookup.

2. Patch / upgrade steps.

   • Track the Gitea project's security advisories and release notes for the commit or release that introduces fingerprint-based SSH key lookup. Apply it to all instances with the built-in SSH server enabled.
   • After upgrading, verify SSH key authentication continues to function for legitimate keys and that lookups are performed by fingerprint.

3. Long-term hardening.

   • Enforce exact-match (fingerprint) identity comparisons for all authentication credentials; avoid LIKE/case-insensitive matching on security-sensitive identifiers.
   • Standardize cryptographic key handling on canonical binary or fingerprint representations rather than case-variant textual encodings.
   • Restrict network access to the Gitea SSH port through firewall rules or bastion hosts to limit the reachable attack surface.
   • Monitor SSH authentication success events per user and baseline normal source addresses to detect anomalous impersonation.

References

• NVD — CVE-2026-103059: https://nvd.nist.gov/vuln/detail/CVE-2026-103059
• Gitea project security advisories and release notes (verify fingerprint-based SSH key lookup fix): https://github.com/go-gitea/gitea/security/advisories
• Gitea documentation — configuration (START_SSH_SERVER): https://docs.gitea.com/administration/config-cheat-sheet
• MITRE ATT&CK — T1078 Valid Accounts: https://attack.mitre.org/techniques/T1078/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-103059 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, or in-the-wild campaign activity was identified in tracked sources at the time of writing.