CVE-2026-58314
CVE-2026-58314: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityHigh8.6
High [CVE-2026-58314] Server-Side Request Forgery via webhooks, repository migration, and OpenID discovery
CVE-2026-58314Source published Source updated
Two SSRF findings in Gitea 1.26.2 A flaw was found in Gitea. This vulnerability, known as Server-Side Request Forgery (SSRF), allows an attacker to trick the server into making requests to internal network resources. A logged-in user can exploit this by crafting malicious webhooks or repository migration configurations, leading to the disclosure of sensitive information from internal hosts. Additionally, if OpenID sign-in is enabled, an unauthenticated attacker can trigger blind GET requests to internal IPs through the OpenID discovery process, which can be used for internal network reconnaissance. A flaw in Gitea's URL parsing logic allows both authenticated users (via webhooks or repository migrations) and unauthenticated users (via OpenID discovery) to trigger HTTP GET requests to…
- Affected products in this advisory
- OpenShift Pipelines
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- 1.27.0
- Mitigation guidance
- To mitigate unauthenticated internal network probes, disable OpenID sign-in by setting `ENABLE_OPENID_SIGNIN = false` in app.ini. To limit SSRF risks from webhooks and repository migrations, configure `ALLOWED_HOST_LIST` to explicitly restrict webhooks to trusted external domains or block private IP ranges.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.