CVE-2026-89430

Executive Summary

CVE-2026-89430 is a time-of-check to time-of-use (TOCTOU) vulnerability in Gitea's push mirror functionality. The application validated a mirror's remote address against the configured [migrations] allow and block lists only at mirror creation time, then passed the stored address directly to git push during every subsequent synchronization. Because the hostname was re-resolved at sync time without re-validation, a repository administrator — including any user who can create their own repository — could direct a push mirror at a hostname that later resolves to an internal or explicitly blocked Git service and force-push repository contents to it. This creates a server-side request forgery (SSRF) and data-exfiltration path from Gitea instances into internal network segments. The vulnerability is currently unpatched, no public PoC exists, and no CVE, EPSS, or CVSS score has been assigned by FIRST.org or NVD beyond the vector inferred from the CWE and description.

Technical Analysis

The defect is a classic CWE-367 (Time-of-Check to Time-of-Use) condition. During push mirror creation, Gitea performs an allow/block list check against the [migrations] configuration. That validation is a point-in-time check: it evaluates the name (hostname/address) supplied by the user at creation. Once the mirror record is persisted, the stored address is used verbatim on each synchronization cycle and handed directly to git push.

The security gap is that no re-validation occurs at use time. Two exploitation primitives follow from this:

1. DNS rebinding / DNS re-resolution. If the attacker controls DNS for the hostname that passed the allow-list check at creation, they can change the A/AAAA record afterward to point at a blocked or internal address (for example an internal Git server on the corporate LAN or a loopback/cloud metadata endpoint). At the next sync, git push resolves the name again and connects to the newly targeted destination.
2. Direct stored-address use. Because the address is passed to git push without re-checking the block list, any name that currently resolves to a blocked range is reachable even if it did not at creation.

The attack requires administrator access to a repository, which the description explicitly notes includes repositories the attacker creates themselves. This lowers the effective privilege bar: any authenticated user permitted to create a repo and configure a push mirror holds the required capability.

The vulnerability class enables SSRF via Git-level protocol traffic and can result in outbound force-push of repository contents (source code, secrets, CI configuration) to an attacker- or internal-controlled Git service. The description does not provide specific Gitea version numbers, configuration key values, or code symbols beyond [migrations] and git push; no further implementation detail is derivable from the available data.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the NVD description.

1. Reconnaissance and target identification. The attacker gains an authenticated account on the Gitea instance (or already holds one) and identifies that push mirroring is enabled. They determine which hostnames pass the [migrations] allow and block lists by creating test mirrors, and identify internal Git services or DNS records they can influence.

2. Triggering the TOCTOU flaw. The attacker creates a push mirror whose remote address is a hostname that resolves to a permitted destination at creation time, satisfying the [migrations] check. This step exploits the check being performed only at creation.

3. Payload / execution at the vulnerability-class level. Before or between synchronization cycles, the attacker changes DNS resolution for the stored hostname so it now points to a blocked or internal target. On the next synchronization, Gitea passes the stored address directly to git push without re-checking the allow/block list, and the connection is directed at the internal Git service. No re-validation gate stands between the stored name and the outbound Git operation.

4. Post-exploitation impact. The synchronization performs a force-push, sending the repository's contents to the targeted internal Git service. This yields (a) exfiltration of source code and any secrets contained in the repository, and (b) SSRF-style access from the Gitea host into internal network segments that are otherwise unreachable to the attacker. Because it is a force-push, history on the destination can be overwritten, and the repository owner can use the Gitea server as a pivot for outbound Git traffic.

Impact Assessment

The blast radius is any Gitea deployment with push mirroring configured and with a [migrations] allow/block list intended to restrict mirror destinations. Impact includes:

• Confidentiality (High): Repository contents, and any embedded credentials or configuration, can be exfiltrated to an attacker-controlled or internal endpoint.
• Integrity (High): The synchronization is a force-push, so downstream/internal Git history can be overwritten with attacker-supplied content.
• Scope (Changed): The Gitea server acts as an outbound pivot into internal networks, an impact beyond the vulnerable component itself.

CVSS subscore rationale (inferred vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N): network-exploitable, low attack complexity, privileges required (repository admin), no user interaction, changed scope, high confidentiality and integrity impact, no direct availability impact. Note: NVD has not published an official CVSS score; the vector above is an analytical estimate and should not be treated as an authoritative value. FIRST.org has not assigned an EPSS score. CVE-2026-89430 is not listed in CISA KEV and no exploit code, Nuclei template, or in-the-wild campaign is known.

Detection Guidance

Sigma Rule

title: Gitea Push Mirror Synchronization to Previously Blocked or Internal Address
id: 9f0c2a51-8943-4a7b-9e10-7c89430a1b00
status: experimental
description: Detects Gitea push mirror synchronization events where the remote address may have changed resolution compared to the allow/block validation performed at mirror creation (CVE-2026-89430 TOCTOU).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-89430
author: Threat Intelligence
date: 2026/01/01
logsource:
  product: gitea
  service: audit
detection:
  selection_event:
    event.action:
      - 'mirror.sync'
      - 'repo.mirror_sync'
  selection_remote:
    remote_address|startswith:
      - 'http://10.'
      - 'http://192.168.'
      - 'http://172.16.'
      - 'http://127.'
      - 'http://169.254.'
  selection_anomaly:
    - dns_resolution_changed: true
    - address_revalidation_skipped: true
  condition: selection_event and (selection_remote or selection_anomaly)
fields:
  - timestamp
  - user
  - repo
  - remote_address
falsepositives:
  - Legitimate mirrors intentionally configured to internal Git services
level: high
tags:
  - attack.t1190
  - cwe.367

YARA Rule

rule CVE_2026_89430_Gitea_PushMirror_TOCTOU
{
    meta:
        description = "Detects Gitea push mirror configuration records referencing internal or loopback addresses consistent with CVE-2026-89430 abuse"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-89430"
        date = "2026-01-01"
        cve = "CVE-2026-89430"
    strings:
        $mig = "[migrations]" ascii nocase
        $push = "git push" ascii nocase
        $mirror = "push_mirror" ascii nocase
        $loop = "127.0.0.1" ascii
        $meta = "169.254.169.254" ascii
        $rfc1918a = "10." ascii
        $rfc1918b = "192.168." ascii
        $rfc1918c = "172.16." ascii
    condition:
        uint32(0) == 0x464C457F or true and
        ($mig and $push and $mirror) or
        ($mirror and 1 of ($loop, $meta, $rfc1918a, $rfc1918b, $rfc1918c))
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $HOME_NET [80,443,3000,8080,8443] (msg:"CVE-2026-89430 Gitea Push Mirror TOCTOU Outbound Git Connection to Internal/Restricted Address"; flow:established,to_server; content:"git-receive-pack"; http_uri; nocase; content:"/info/refs"; http_uri; nocase; reference:cve,2026-89430; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-89430; classtype:attempted-recon; sid:2026894301; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=30s
  [process where process.name == "git" and process.args : "push"]
  [network where destination.ip != null and
     (cidr_match(destination.ip, "10.0.0.0/8") or
      cidr_match(destination.ip, "172.16.0.0/12") or
      cidr_match(destination.ip, "192.168.0.0/16") or
      cidr_match(destination.ip, "127.0.0.0/8"))]

Splunk SPL Query

index=gitea OR index=syslog OR index=audit sourcetype=gitea:*
| search (action="mirror.sync" OR action="repo.mirror_sync" OR message="*mirror*sync*")
| rex field=remote_address "://(?<mirror_host>[^/:]+)"
| where match(mirror_host, "^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.|169\.254\.)")
| stats count values(mirror_host) as hosts values(user) as users by repo, src_ip
| where count > 0
| table repo, users, hosts, src_ip, count

Wazuh OSSEC Rule

<group name="gitea,cve-2026-89430,">
  <rule id="2026894" level="12">
    <decoded_as>json</decoded_as>
    <field name="action">mirror.sync</field>
    <field name="remote_address" type="pcre2">https?://(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.|169\.254\.)</field>
    <description>CVE-2026-89430: Gitea push mirror synchronization to internal or restricted address detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_89430,ssrf,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected version range is available.

1. Immediate mitigations

• Disable push mirroring entirely on Gitea instances where it is not operationally required.
• Restrict repository creation privileges so that untrusted users cannot create repositories and thus cannot configure push mirrors.
• Enforce egress filtering on the Gitea host: block outbound Git traffic to RFC1918, loopback, and link-local ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8, 169.254.0.0/16).
• Pin DNS resolution for mirror destinations via a controlled resolver or hosts entry, and monitor for post-creation DNS changes.
• Ensure the [migrations] allow list is as restrictive as possible; note that this control is NOT sufficient on its own because it is only applied at creation time.

2. Patch / upgrade steps

• No patched version is presently identified. Track the Gitea project's release notes and security advisories for a fix that re-validates the mirror address at synchronization time.
• Until a fix is released, treat all Gitea versions as potentially affected.

3. Long-term hardening

• Require re-validation of mirror remote addresses on every synchronization, not only at creation, and resolve-and-pin addresses server-side.
• Adopt a strict egress allow-list architecture so a compromised application cannot reach internal Git services.
• Enforce least privilege on repository creation and mirror configuration.
• Add audit logging and alerting on mirror synchronization events and on changes to mirror remote addresses.

References

• NVD — CVE-2026-89430: https://nvd.nist.gov/vuln/detail/CVE-2026-89430
• CWE-367 — Time-of-check Time-of-use (TOCTOU) Race Condition: https://cwe.mitre.org/data/definitions/367.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Gitea project security advisories: https://github.com/go-gitea/gitea/security/advisories
• FIRST.org EPSS (no score assigned for CVE-2026-89430 as of this writing): https://www.first.org/epss/

No known threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-89430 at this time. CVE-2026-89430 is not listed in CISA KEV. No public PoC, exploit code, or Nuclei template is available.