CVE-2026-70357: Gitea

High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days.

Gitea validates a repository migration hostname against its network allow and block lists before invoking Git, but the Git subprocess independently resolves the hostname when connecting. An attacker who can start a migration and control the destination's DNS can change the address between validation and connection to reach a blocked internal address. The affected path is the Git clone operation; validation in the migration HTTP client's dialer does not protect the independently connecting Git subprocess.

Affected products

• Gitea Gitea: up to and including 1.27.3

Published 2026-10-06. Last modified 2026-10-07.