CVE-2026-79960— Gitea deploy key pushes acting as the repository owner
Quick assessment
Affected
Gitea Gitea
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
当推送操作使用部署密钥（deploy key）进行身份验证时，Gitea 会将仓库所有者记录为推送者，因此推送钩子（push hook）管道中的权限检查会针对仓库所有者而非部署密钥进行。拥有可写部署密钥的攻击者可以在未列入标签（tag）允许列表的情况下创建受保护的标签，并通过推送选项（push options）更改仓库可见性，例如将私有仓库公开。此外，通过 AGit 流程使用部署密钥创建的拉取请求（pull requests）也被归因于仓库所有者。
Possible ATT&CK Techniques 2 AI
T1484.001 · Group Policy Modification T1098.003 · Additional Cloud Roles
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-79960
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Gitea deploy key pushes acting as the repository owner
Source: CVE Program / CVE List V5
Vulnerability Description
When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission checks in the push hook pipeline evaluated the owner instead of the deploy key. A holder of a writable deploy key could create protected tags without being on the tag allow list and change repository visibility through push options, for example making a private repository public. Pull requests created through the AGit flow with a deploy key were also attributed to the owner.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-79960
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-79960
请登录查看更多情报信息。
Other References for CVE-2026-79960 (4)
-
https://github.com/go-gitea/gitea/releases/tag/v28.0.0 release-notes
-
https://blog.gitea.com/release-of-28.0.0/ release-notes
Same Patch Batch · Gitea · 2026-10-06 · 21 CVEs total
| CVE-2026-104636 | Gitea SSRF through Git HTTP redirects in mirrors and fetches | |
| CVE-2026-73278 | Gitea WebAuthn bypass during OAuth and OIDC sign-in | |
| CVE-2026-70357 | Gitea repository migration SSRF through DNS rebinding | |
| CVE-2026-96580 | Gitea Actions memory exhaustion through large static matrices | |
| CVE-2026-96589 | Gitea private repository access retained after rejected transfer | |
| CVE-2026-96400 | Gitea migration SSRF to reserved addresses through ALLOWED_DOMAINS | |
| CVE-2026-96399 | Gitea denial of service through external issue tracker patterns | |
| CVE-2026-96404 | Gitea installer authentication bypass for existing accounts | |
| CVE-2026-104626 | Gitea fork workflow job revival through later approval | |
| CVE-2026-104632 | Gitea fork workflow approval bypass through cancel and rerun | |
| CVE-2026-94205 | Gitea fork workflow approval bypass through maintainer-triggered events | |
| CVE-2026-101027 | Gitea migration SSRF through ALLOWED_DOMAINS address check bypass | |
| CVE-2026-101029 | Gitea migration and pull mirror SSRF through multi-answer DNS | |
| CVE-2026-95106 | Gitea review and execution mismatch through duplicate tree entries | |
| CVE-2026-95112 | Gitea issue reference parsing CPU exhaustion | |
| CVE-2026-89430 | Gitea push mirror SSRF and forced writes to internal Git hosts | |
| CVE-2026-103504 | Gitea API team demotion not applied to unit permissions | |
| CVE-2026-103667 | Gitea container registry stored XSS through blob media type | |
| CVE-2026-103059 | Gitea built-in SSH server authentication bypass through key case folding | |
| CVE-2026-103670 | Gitea trusted workflow cancellation by unapproved fork runs |
IV. Related Vulnerabilities
Same product: Gitea
-
CVE-2026-73278
Gitea WebAuthn bypass during OAuth and OIDC sign-in -
CVE-2026-96589
Gitea private repository access retained after rejected tran -
CVE-2026-96580
Gitea Actions memory exhaustion through large static matrice -
CVE-2026-96404
Gitea installer authentication bypass for existing accounts -
CVE-2026-96400
Gitea migration SSRF to reserved addresses through ALLOWED_D
Same vendor: Gitea
-
CVE-2026-73278
Gitea WebAuthn bypass during OAuth and OIDC sign-in -
CVE-2026-96589
Gitea private repository access retained after rejected tran -
CVE-2026-96580
Gitea Actions memory exhaustion through large static matrice -
CVE-2026-96404
Gitea installer authentication bypass for existing accounts -
CVE-2026-96400
Gitea migration SSRF to reserved addresses through ALLOWED_D
Same weakness: CWE-863
-
CVE-2026-106458
Backstage: Inconsistent repository filtering in Bitbucket Se -
CVE-2026-106456
Backstage: Inconsistent credential enforcement for overlappi -
CVE-2026-103007
Incorrect Authorization in Elasticsearch Leading to Privileg -
CVE-2026-102412
Incorrect Authorization in Kibana Leading to Sensitive Infor -
CVE-2026-102407
Incorrect Authorization in Elasticsearch Leading to Unauthor
V. Comments for CVE-2026-79960
No comments yet