CVE-2026-103059: Gitea SSH Server Authentication Bypass via Key Case Folding
Summary
CVE-2026-103059: Gitea built-in SSH server authentication bypass through key case folding. Affects gitea versions < 28.0.0. Fixed in 28.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Gitea is an open-source self-hosted Git service that provides a user-friendly interface for managing Git repositories. It includes features such as issue tracking, pull requests, and a built-in SSH server for secure access to repositories. However, vulnerabilities in its SSH server can pose significant security risks, particularly when authentication mechanisms are compromised.
Vulnerability Detail
The vulnerability arises from the way Gitea's built-in SSH server handles public key authentication. When the SSH server is enabled, it performs a case-insensitive SQL 'LIKE' comparison to look up the presented public key. This behavior is problematic because it allows an attacker to create a case variant of a legitimate user's RSA public key. If the attacker can derive the corresponding private key, they could authenticate as the victim user, gaining unauthorized access to the victim's account. This vulnerability is particularly severe when using databases like SQLite, where the case-insensitive comparison can lead to successful authentication without the user's consent.
How To Fix
Minimum fixed version
28.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the built-in SSH server by setting START_SSH_SERVER = false in your Gitea configuration file until you can apply the patch.
Conclusion
CVE-2026-103059 presents a critical security risk for Gitea users with the SSH server enabled. It is essential to update to version 28.0.0 or later to mitigate this vulnerability. Additionally, disabling the SSH server can serve as a temporary measure until the update is applied.
See every vulnerability recorded for gitea →
FAQ
CVE-2026-103059 is a vulnerability in Gitea's built-in SSH server that allows for authentication bypass through case folding of public keys.
If your Gitea installation has the SSH server enabled, an attacker could potentially authenticate as another user by exploiting this vulnerability.
All versions of Gitea prior to 28.0.0 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you cannot update Gitea right away, consider disabling the SSH server as a temporary workaround to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for gitea.
