CVE-2026-109553 Gitea CVE debrief

Who should care

Defenders responsible for Gitea instances, particularly those that trust a user certificate authority and accept arbitrary principals, should assess exposure and verify their instances are running version 28.2.0 or later.

Why it matters

Defenders should prioritize verifying Gitea instances that trust a user certificate authority and accept arbitrary principals, and ensure they are running version 28.2.0 or later to prevent potential impersonation and unauthorized access.

• Potential impersonation of other users through SSH certificate principal manipulation
• Possible unauthorized access to Gitea instances through HTTP signature API and built-in SSH server

Technical summary

Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. When Gitea trusts a user certificate authority and accepts arbitrary principals, a user could register another user's public key line as their own principal, or a holder of a certificate signed by that authority could list it, and then authenticate as the owner of that key through the HTTP signature API and the built-in SSH server.

Defensive priority

Defenders should prioritize verifying Gitea instances that trust a user certificate authority and accept arbitrary principals, and ensure they are running version 28.2.0 or later.

Recommended defensive actions

• Verify Gitea instances that trust a user certificate authority and accept arbitrary principals.
• Ensure Gitea instances are running version 28.2.0 or later.
• Review and update Gitea configurations to restrict principal access.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and source item provide details on the vulnerability, including the affected product, Gitea, and the conditions under which the vulnerability can be exploited. Defenders should verify Gitea instances that trust a user certificate authority and accept arbitrary principals. Verification involves checking if instances are running version 28.2.0 or later and reviewing configurations to restrict principal access. Evidence from the CVE record and source item suggests that instances not trusting a user certificate authority or

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.