DEV Community

StarkMan
StarkMan

Posted on

Sizing a self-hosted forge: finding Gitea instances before you patch

#security #gitea #assetmanagement #vulnerability

Sizing a self-hosted forge: finding Gitea instances before you patch

Patch management for a self-hosted product starts with a question the vendor cannot answer: how many of these do we run, and which of them face the internet. Gitea's 28.0.0 and 28.1.0 releases fixed 27 security issues, including CVE-2026-103670, a trusted workflow cancellation reachable by an unapproved fork run. Before any of that matters, the fleet has to be known.

Vulnerability overview

The release roundup reports one Critical, four High and five Medium issues among the 27, with the remainder unrated. CVE-2026-103670 carries a CVSS v3 score of 7.5 alongside the Actions approval family. The highest score in the set, 9.1, belongs to CVE-2026-103059, which affects the built-in SSH server, and CVE-2026-96404 at 8.1 covers a web installer that can issue an admin session without a password check. CVE-2026-103670 sits in the middle of that range and, like the rest, has no confirmed exploitation in the wild.

Why inventory decides the work

A forge is usually a single host per team or per organisation, deployed by a developer rather than by a platform group. That pattern produces a fleet of small, long-lived, lightly documented installations. Some were set up from a container image two years ago and never revisited. Others run behind a reverse proxy on a well-known hostname. The difference in exposure between those two cases is larger than the difference in severity between the CVEs in this release.
The practical implication is that a Gitea upgrade is an inventory problem first and a patching problem second. A list of hostnames derived from a load balancer's configuration will miss the instance a developer stood up on a spare virtual machine and pointed at through a tunnel.

Mechanism and exploitation conditions

The internet-facing part of the question is answerable with fingerprint data. A product fingerprint identifies hosts presenting characteristic responses, and for a self-hosted forge that response appears in the HTML title, headers and static assets of the web interface. A host that presents the fingerprint and answers from a public address is reachable by anyone who runs the same query.
Reachability is not exploitability. CVE-2026-103670 needs fork workflows enabled, and the other Actions items need comparable configuration. The SSH key flaw needs the built-in SSH server to be in use. Each condition narrows the set, and none of them is visible from outside.

Impact

An unknown instance is an unpatched instance with a delay attached. The measured cost of a compromised forge is high because source code, pipeline tokens and deployment credentials share a host. The installer and SSH key flaws reach administrative control, which turns one overlooked host into a path into everything the pipelines can touch.

Affected products and scope

Gitea 1.27.3 and earlier carries all 27 issues once the two trains are counted. Gitea 28.0.0 carries the eight fixed in 28.1.0. The upgrade target is 28.1.0 for every installation, regardless of how it was deployed.

Exposure context

A ZoomEye search for app="Gitea" matched 116,431 assets on 2026-10-07, measured against a threshold of 100. The result describes hosts that match the Gitea fingerprint and does not report versions or configuration. Running the same query against an organisation's own address space, or against domain= scopes for its registered domains, converts the public figure into a candidate list. A query for vul.cve="CVE-2026-103670" returned no indexed assets, which is expected for a newly published identifier and does not indicate the fleet is clean.

Remediation and mitigations

Build the list, then patch to Gitea 28.1.0. Use external fingerprint data for the internet-facing subset and network scanning plus asset records for the internal one. Confirm the build number rather than the UI version string, since deployments sometimes pin a container tag that lags the binary. For instances that cannot be upgraded this week, keep the web installer unreachable, restrict migration and mirror creation, and require approval for fork pull request workflows.

References

Top comments (0)