Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-109553— Gitea SSH certificate principal impersonation of other users

Quick assessment

Affected
Gitea Gitea
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Gitea 在解析 SSH 证书的主体（principals）时，错误地遍历了所有已存储的公钥内容，而本应仅检查专门用于主体的密钥。当 Gitea 配置为信任用户证书颁发机构（ ）并允许任意主体（ ）时，攻击者可以将其他用户的公钥行注册为自己的主体，或者持有由该机构签发的证书的用户也可以列出该公钥，随后通过 HTTP 签名 API 及内置 SSH 服务器冒充该公钥的拥有者进行身份验证。未配置信任用户证书颁发机构的实例不受此问题影响。

AI Predicted 8.8 Difficulty: Moderate

Affected Version Matrix 1

VendorProduct Version RangeStatus
Gitea Gitea ≤ 28.1.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-109553

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Gitea SSH certificate principal impersonation of other users
Source: CVE Program / CVE List V5
Vulnerability Description
Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. When Gitea trusts a user certificate authority (`SSH_TRUSTED_USER_CA_KEYS`) and accepts arbitrary principals (`SSH_AUTHORIZED_PRINCIPALS_ALLOW=anything`), a user could register another user's public key line as their own principal, or a holder of a certificate signed by that authority could list it, and then authenticate as the owner of that key through the HTTP signature API and the built-in SSH server. Instances that do not trust a user certificate authority are not affected.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Gitea Gitea 0 ~ 28.1.0 -

II. Public POCs for CVE-2026-109553

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-109553

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-109553 (2)

Vendor Advisories for CVE-2026-109553 (1)

Other References for CVE-2026-109553 (1)

Same Patch Batch · Gitea · 2026-10-18 · 12 CVEs total

CVE-2026-104627 Gitea OpenID account linking without session binding
CVE-2026-105661 Gitea panic on the repositories route of individual users
CVE-2026-105964 Gitea Actions artifact v4 API unbounded request body
CVE-2026-109844 Gitea watched repositories API disclosure after access revocation
CVE-2026-107618 Gitea cross-site request forgery on repository topics
CVE-2026-107686 Gitea reactions accepted on locked issues and comments
CVE-2026-110494 Gitea release attachment re-linking of issue attachments
CVE-2026-110324 Gitea private profile information disclosure through POST request
CVE-2026-110311 Gitea draft release creation disclosing attachment metadata
CVE-2026-97204 Gitea label deletion across repository and organization IDs
CVE-2026-97859 Gitea API disclosure of private user social graph, keys and stars

IV. Related Vulnerabilities

Same product: Gitea
Same vendor: Gitea

V. Comments for CVE-2026-109553

No comments yet

Leave a comment