What’s Vulnerable › Vulnerabilities

CVE-2026-109553: Gitea SSH certificate principal impersonation of other users

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-18 · updated 2026-10-19

Description

Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. When Gitea trusts a user certificate authority (`SSH_TRUSTED_USER_CA_KEYS`) and accepts arbitrary principals (`SSH_AUTHORIZED_PRINCIPALS_ALLOW=anything`), a user could register another user's public key line as their own principal, or a holder of a certificate signed by that authority could list it, and then authenticate as the owner of that key through the HTTP signature API and the built-in SSH server. Instances that do not trust a user certificate authority are not affected.

Affected products

• Gitea Open Source Git Server: through 28.1.0

References

• https://blog.gitea.com/release-of-28.2.0/
• https://github.com/go-gitea/gitea/pull/39839
• https://github.com/go-gitea/gitea/pull/39847
• https://github.com/go-gitea/gitea/releases/tag/v28.2.0
• https://github.com/go-gitea/gitea/security/advisories/GHSA-vcp6-2qc6-gvq3

Get alerted when CVE-2026-109553 or the next vulnerability affects your stack