Threats Tagged 'cve-2026-54481'

Gitea's internal API HTTP client hardcodes TLSClientConfig.InsecureSkipVerify=true without any configuration override, allowing it to accept any TLS certificate when communicating over HTTPS. This affects deployments where internal API calls are made over a network (split-host or multi-pod topologies) rather than loopback. An attacker positioned on the internal network segment can perform a man-in-the-middle attack to capture the static high-privilege INTERNAL_TOKEN used for authenticating all internal API endpoints. This token grants access to sensitive operations such as server control, SSH key authorization, git command execution, and more. The vulnerability has existed since 2017 and affects all versions prior to 1.27.0. Severity depends on deployment configuration, being high for split-host HTTPS setups and low or informational for single-host loopback deployments.