Gitea Patches 27 Security Flaws, Including Critical SSH Authentication Bypass and SSRF

Cybersecuritynews •Abinaya • October 8, 2026

Gitea has released security updates addressing 27 reported flaws across versions 28.0.0 and 28.1.0, including a critical SSH authentication bypass and server-side request forgery (SSRF) weaknesses. The fixes cover account access, repository permissions, automated workflows, and connections to internal systems. Administrators should treat the update as an urgent priority for their development infrastructure. Released on […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Gitea Releases Urgent Security Updates for 27 Vulnerabilities Gitea has released versions 28.0.0 and 28.1.0 on October 6, 2026, addressing 27 vulnerabilities, including critical flaws like CVE-2026-94205 and CVE-2026-95106. These vulnerabilities allow attackers to bypass SSH authentication and exploit server-side request forgery (SSRF) weaknesses. The flaws impact repository access, automated workflows, and internal connections, posing significant risks to self-hosted Gitea instances. Administrators are urged to upgrade immediately to mitigate these issues, which could lead to unauthorized access and execution of untrusted code. The vulnerabilities were disclosed on October 6, 2026, with CVSS scores indicating critical and high severity levels. Gitea's updates include fixes for account impersonation and workflow execution without approval, enhancing security for users. The situation requires immediate attention from administrators to safeguard their systems. 3 sources 73

Gitea Patches 27 Security Flaws, Including Critical SSH Authentication Bypass and SSRF

The full story

Extracted Entities

CWE Weaknesses (2)

Platforms (1)