What’s Vulnerable › Vulnerabilities

CVE-2026-91773: Soft Serve 0.7.1 through 0.11.6 Information Disclosure via LFS Locks

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-15 · updated 2026-09-16
• Weakness: CWE-639

Description

Soft Serve versions 0.7.1 through 0.11.6 fail to scope Git LFS lock queries by repository, allowing authenticated users to read lock metadata from repositories they cannot access. Attackers with write access to any repository can enumerate lock IDs globally to recover locked file paths, usernames, and lock timestamps from private repositories.

Affected products

• charmbracelet soft-serve: from 0.7.1 before 0.12.0 — fixed in 0.12.0

How to fix

Upgrade to a fixed version: charmbracelet soft-serve 0.12.0. Check the vendor advisory for mitigations.

References

• https://github.com/charmbracelet/soft-serve
• https://github.com/charmbracelet/soft-serve/blob/v0.11.6/pkg/store/database/lfs.go#L115-L124
• https://github.com/charmbracelet/soft-serve/commit/e34914699128c937afad167d43ccb5310e48b319
• https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-xqg9-4q65-m2wf
• https://www.vulncheck.com/advisories/soft-serve-0.7.1-through-0.11.6-information-disclosure-via-lfs-locks

Get alerted when CVE-2026-91773 or the next vulnerability affects your stack