DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-58426: CVE-2026-58426: Cryptographic Boundary-Shifting in Gitea Actions Artifacts

#security #cve #cybersecurity

CVE-2026-58426: Cryptographic Boundary-Shifting in Gitea Actions Artifacts

Vulnerability ID: CVE-2026-58426
CVSS Score: 9.6
Published: 2026-07-21

CVE-2026-58426 is a critical security vulnerability in Gitea Actions where improper signature serialization allows an authenticated attacker to execute a canonicalization (boundary-shifting) attack. By rewriting query parameters while keeping the signature intact, the attacker can bypass access control checks to read private workflow artifacts or modify concurrent task upload states.

TL;DR

A boundary-shifting vulnerability in Gitea Actions signed URLs enables attackers to modify URL parameters while preserving valid cryptographic signatures, exposing private workflow artifacts and interfering with concurrent builds.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-347
  • Attack Vector: Network
  • CVSS Score: 9.6
  • EPSS Score: 0.00177
  • Impact: Cross-Repository Read / Cross-Task Write
  • Exploit Status: Proof of Concept
  • KEV Status: Not Listed

Affected Systems

  • Gitea with Gitea Actions enabled
  • Gitea: >= 1.22.0, <= 1.26.1 (Fixed in: 1.26.2)

Code Analysis

Commit: 1c2d5e9

Fix artifacts signature verification canonicalization flaw by length-prefixing and tag domains

Mitigation Strategies

  • Upgrade Gitea to version v1.26.2 or newer to enforce length-prefixed URL signing.
  • Disable the Gitea Actions subsystem globally if immediate patching is not feasible.
  • Employ WAF rules filtering twirp endpoint paths (/twirp/github.actions.results.api.v1.ArtifactService).

Remediation Steps:

  1. Identify active Gitea deployment environments and check current version indicators.
  2. Download Gitea release package v1.26.2 or higher from official channels.
  3. Perform a full database backup prior to migration operations.
  4. Apply the patch or swap the binary, then verify the database migration completes successfully.
  5. Confirm Gitea Actions functionality recovers with length-prefix signatures by examining generated query routes.

References

Read the full report for CVE-2026-58426 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)