Home › CVE Intelligence › CVE-2026-22874
CVSS 9.6 CRITICAL Security Vulnerability

CVE-2026-22874: Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter

Summary Gitea's default SSRF allow-list ([MatchBuiltinExternal](https://github.com/go-gitea/gitea/blob/4c37f4dacbac022f7beca75272439331f0368830/modules/hostmatcher/hostmatcher.go#L26-L27), used by both webhook delivery…

9.6CVSS Score
CRITICALSeverity
NOCISA KEV
0.5%EPSS Score
Security VulnerabilityImpact Type

📋 Vulnerability Details

CVE IDCVE-2026-22874
VendorUnknown Vendor
Affected ProductUnknown Product
Vulnerability TypeSecurity Vulnerability
CVSS Score9.6 (CRITICAL)
EPSS Score0.5% probability of exploitation in the next 30 days
Actively Exploited❌ No known exploitation
Patch StatusPending Vendor Disclosure
Reported ByCYBERDUDEBIVASH SENTINEL APEX Intelligence (via sentinel_apex)

🔬 Technical Analysis

#

Summary

Gitea's default SSRF allow-list ([MatchBuiltinExternal](https://github.com/go-gitea/gitea/blob/4c37f4dacbac022f7beca75272439331f0368830/modules/hostmatcher/hostmatcher.go#L26-L27), used by both webhook delivery and repository migrations) relies on Go's standard libr... [Full analysis available on Pro]

🎯 Known Indicators of Compromise

{"type":"sha1","value":"4c37f4dacbac022f7beca75272439331f0368830","confidence_score":0.9,"first_seen":"2026-07-22","source_count":1} {"type":"url","value":"https://github.com/go-gitea/gitea/blob/4c37f4dacbac022f7beca75272439331f0368830/modules/hostmatcher/","confidence_score":0.82,"first_seen":"2026-07-22","source_count":1}
⚡ DETECTION RULES AVAILABLE

Get CVE-2026-22874 Detection Pack

Sigma rules, YARA signatures, IOC table, and SIEM queries for Splunk, Elastic, Sentinel, and Chronicle — deployable in 5 minutes.

✓ Sigma Rules ✓ YARA Pack ✓ IOC Table ✓ SIEM Queries
🛡️ Get Detection Pack → 🔌 Access via API →

🔗 Related Intelligence