CVE-2026-104636

Executive Summary

CVE-2026-104636 is a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) in Gitea, the self-hosted Git service. The application correctly validated the initial remote URL for push mirrors, wiki remote checks, and migrated pull request head fetches, but the subsequent raw Git operations followed HTTP redirects without revalidating the redirect destination against the configured outbound host policy. A repository administrator who controls a policy-allowed endpoint that returns a redirect can therefore cause Gitea's Git client to issue requests to addresses that the outbound host policy would otherwise block, resulting in access to internal services reachable from the Gitea server.

Technical Analysis

The flaw is a classic SSRF via incomplete validation of a redirect chain — a well-known subclass of CWE-918. The relevant security control in Gitea is an outbound host policy that restricts which remote addresses the server is permitted to contact. Per the NVD description, this control was applied at the point of initial validation for three distinct features:

• Push mirrors — the initial remote URL is validated before the mirror is configured.
• Wiki remote checks — the initial wiki remote URL is validated before the check is performed.
• Fetches of migrated pull request heads — the initial PR head remote URL is validated before the fetch.

In each case, validation of the initial URL is insufficient because the underlying raw Git operations (i.e., the Git client invoked by Gitea to perform the actual transfer) subsequently follow HTTP redirects. When the redirect target is an address that was never validated against the outbound host policy, the Git client transparently connects to it. This is a validation-bypass through redirect chaining: the policy enforcement point is placed on the first hop, but the effective destination is determined by a subsequent, unvalidated hop.

Two conditions are prerequisites for exploitation:

1. Attacker control over a policy-allowed endpoint that issues a redirect. The description states "a repository administrator using a policy-allowed endpoint that redirects," indicating the attacker must be able to influence a URL that passes the initial validation and that responds with an HTTP redirect to an internal destination.
2. The Gitea server must be running with an outbound host policy configured. The description explicitly notes "the impact depends on the configured policy and the internal services reachable from the server." Without such a policy, there is little meaningful restriction to bypass; the vulnerability's severity is therefore configuration-dependent.

The attack surface therefore consists of the mirror, wiki-remote, and PR-migration ingestion paths — features that legitimately cause the server to make outbound HTTP(S) requests on behalf of a repository administrator.

No function names, class names, URL endpoints, or API parameters are available from the supplied intelligence; the analysis above is limited to the vulnerability class and the mechanism explicitly described.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (SSRF via redirect) and the specific features named in the NVD description. No specific code patterns or hypothetical function names are asserted.

1. Reconnaissance / target identification. The attacker identifies a Gitea instance where they hold repository-administrator privileges (or can influence a repository they administer) and where an outbound host policy is configured. The attacker also needs a URL that is allowed by that policy and that they can make issue a redirect — for example, a host under the allowed list that the attacker controls or can influence.

2. Triggering the flaw. Using one of the affected features — configuring a push mirror, performing a wiki remote check, or triggering a fetch of a migrated pull request head — the attacker supplies the policy-allowed, redirecting URL as the initial remote. Because this initial URL is validated and passes policy, Gitea accepts it and proceeds to the raw Git operation.

3. Payload / execution at the vulnerability-class level. The allowed endpoint responds with an HTTP redirect (3xx). The raw Git operation follows the redirect without revalidating the destination against the outbound host policy. The Git client is then directed to the attacker-chosen internal address. The "payload" is the redirect itself — no code execution is required; the redirect simply re-targets the outbound request. The attacker may use this to direct requests to internal services reachable from the Gitea server.

4. Post-exploitation impact. The consequences depend on (a) the outbound policy that was bypassed and (b) which internal services are reachable from the Gitea host. Potential outcomes include reaching internal-only HTTP services, interacting with cloud metadata endpoints, or performing internal reconnaissance/port discovery via response differences. The description does not specify exfiltration, credential theft, or remote code execution, so those outcomes are not asserted here.

Impact Assessment

• Confidentiality / Integrity: The primary effect is that the server can be induced to communicate with addresses the operator intended to block. This can expose information about — or permit interaction with — internal services. Because the request is generated by the Gitea server, it may carry the server's network position and any implicitly trusted context.
• Scope: The NVD description qualifies impact as dependent on the configured policy and the set of internal services reachable from the server. Blast radius is therefore environment-dependent rather than universally critical.
• Privileges required: Exploitation requires the ability to act as, or influence, a repository administrator who can configure the affected remote settings — a privileged position within the Gitea instance.
• CVSS: No CVSS score or vector was provided in the source intelligence. The vector shown in METADATA is an analyst-derived estimate consistent with a privileged, network-reachable SSRF with environmental dependence; it is not an authoritative NVD score. No EPSS score has been assigned by FIRST.org, and this report does not fabricate one.
• KEV / Exploitation status: CVE-2026-104636 is not listed in CISA KEV. No public proof-of-concept, exploit code, or Nuclei template is known.

Detection Guidance

Detection should focus on outbound HTTP(S) requests originating from the Gitea server that traverse a redirect to an address outside the intended allow-list, and on the mirror/wiki/migration configuration events that precede them.

Sigma Rule

title: Gitea SSRF via Unvalidated HTTP Redirect in Remote Git Operations
id: 7f3b9c2e-4a1d-4e6f-9b2a-0c5d8e1f2a34
status: experimental
description: Detects Gitea outbound requests to restricted/internal destinations following an HTTP redirect during mirror, wiki remote, or migrated PR head fetches (CVE-2026-104636)
logsource:
  category: network_connection
  product: gitea
detection:
  selection_redirect:
    http.response.status_code:
      - 301
      - 302
      - 303
      - 307
      - 308
  selection_internal:
    destination.ip|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
      - '127.0.0.0/8'
      - '169.254.0.0/16'
  condition: selection_redirect and selection_internal
falsepositives:
  - Legitimate mirrors hosted on internal infrastructure
level: medium
tags:
  - attack.t1190
  - cwe.918

YARA Rule

rule CVE_2026_104636_Gitea_SSRF_Redirect
{
    meta:
        author = "valtersit.com"
        description = "Detects Gitea mirror/wiki/PR migration configuration referencing redirecting remote URLs associated with CVE-2026-104636"
        reference = "CVE-2026-104636"
        date = "2026-01-01"
        severity = "medium"
    strings:
        $mirror = "mirror" nocase
        $wiki   = "wiki" nocase
        $prhead = "pull request head" nocase
        $fetch  = "fetch" nocase
        $remote = "remote" nocase
    condition:
        filesize < 1MB and
        (($mirror and $remote) or ($wiki and $remote) or ($prhead and $fetch))
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-104636 Gitea SSRF Redirect to Internal Host"; flow:established,to_server; http.response_status_code:302; http.header; content:"Location"; nocase; pcre:"/Location\x3a\x20https?:\/\/(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.|169\.254\.)/i"; classtype:attempted-recon; sid:2026104636; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=5s
  [network where process.name in ("git", "gitea") and http.response.status_code in (301, 302, 303, 307, 308)]
  [network where process.name in ("git", "gitea") and destination.ip in ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8", "169.254.0.0/16")]

Splunk SPL Query

index=gitea OR index=network sourcetype=netflow OR sourcetype=proxy
| search (http_status=301 OR http_status=302 OR http_status=303 OR http_status=307 OR http_status=308)
| where cidrmatch("10.0.0.0/8", dest_ip) OR cidrmatch("172.16.0.0/12", dest_ip) OR cidrmatch("192.168.0.0/16", dest_ip) OR cidrmatch("169.254.0.0/16", dest_ip)
| stats count values(dest_ip) as internal_targets by src_ip, host
| where count > 0

Wazuh OSSEC Rule

<group name="gitea,ssrf,">
  <rule id="104636" level="10">
    <decoded_as>json</decoded_as>
    <field name="http.response.status_code">30[12378]</field>
    <field name="destination.ip">10\.0\.0\.0|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.|169\.254\.</field>
    <description>CVE-2026-104636: Gitea outbound request redirected to internal/restricted address (SSRF)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or fixed version is provided in the source intelligence. The following are general defenses for SSRF-via-redirect given the stated configuration dependence.

1. Immediate mitigations

   • Restrict the outbound host policy so that the set of policy-allowed destinations cannot issue redirects to internal ranges — ideally block or strip redirects entirely for Git operations, or disallow the allowed endpoints from responding with 3xx.
   • Apply network-layer egress filtering so that the Gitea server cannot reach internal ranges or cloud metadata endpoints (e.g., 169.254.169.254) regardless of redirect, enforcing deny-by-default egress.
   • Restrict who can configure push mirrors, wiki remotes, and migrated pull request heads to trusted administrators, and audit existing configurations for remote URLs pointing at redirecting endpoints.

2. Patch / upgrade steps

   • No patch is currently available per tracked sources. Monitor the Gitea project's security advisories and release notes for a fix that revalidates redirect destinations against the outbound host policy after each redirect hop.
   • When a fixed version is published, upgrade immediately and re-verify the outbound host policy is re-applied to redirect targets.

3. Long-term hardening

   • Adopt redirected-request handling that revalidates every hop of a redirect chain at the enforcement point, rather than validating only the initial URL (validate-then-follow is insufficient).
   • Enforce deny-by-default egress with an allow-list, and treat metadata endpoints and RFC1918 ranges as always-blocked for application-initiated requests.
   • Segment the Gitea server so that internal services reachable from it are minimized, reducing the blast radius of any future SSRF.

References

• NVD — CVE-2026-104636: https://nvd.nist.gov/vuln/detail/CVE-2026-104636
• CWE-918 — Server-Side Request Forgery (SSRF): https://cwe.mitre.org/data/definitions/918.html
• MITRE ATT&CK — T1190, Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Gitea project security advisories (monitor for fix): https://github.com/go-gitea/gitea/security/advisories
• CISA Known Exploited Vulnerabilities catalog (CVE-2026-104636 not listed at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns and no exploit-in-the-wild evidence are known for CVE-2026-104636 based on the supplied intelligence.