Follow-up to Carrot disclosure: Forgejo

News.Ycombinator • April 30, 2026

Since I published Carrot disclosure: Forgejo two days ago, numerous things happened:

Nonetheless, some productive good faith conversations have been had as well, and it seems that experimenting with odd vulnerability disclosure schemes is frowned upon. So I ended up sending and email to Forgejo security team, containing: an apology, a bit my reasoning for proceeding with carrot disclosure, recommendations what to harden/review, and a bunch of commented exploits/proof-of-concepts as attachment. We'll see how it goes.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Vulnerabilities Discovered in Forgejo Following Carrot Disclosure A security researcher identified multiple vulnerabilities in Forgejo, a software platform used by Fedora, including SSRF, cryptographic issues, and authentication flaws. The researcher was able to chain these vulnerabilities to achieve remote code execution (RCE) and other exploits, although the RCE relies on non-default configurations. The researcher opted for a 'Carrot Disclosure' approach, publishing a redacted exploit to encourage Forgejo to improve its security posture. Following this disclosure, the researcher engaged in discussions with Forgejo's security team, providing recommendations and proof-of-concept exploits. The situation remains dynamic as Forgejo's response is awaited. 2 sources 55

Extracted Entities

Companies (1)

Forgejo