Live › vulnerability › CVE-2026-109553
Go to dashboardGitea matched SSH certificate principals against the contents of every stored public key, not only principal keys. With a trusted user certificate authority and arbitrary principals allowed, an attacker can register another user's key line as their principal and authenticate as that user over SSH.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only Gitea instances that trust a user certificate authority through SSH_TRUSTED_USER_CA_KEYS and accept arbitrary principals through SSH_AUTHORIZED_PRINCIPALS_ALLOW=anything. Instances that do not trust a user certificate authority are not affected, and the sources do not give further detail on other configurations.
No product ranges from the sources yet.
SSH_TRUSTED_USER_CA_KEYS is set in the Gitea configuration file (app.ini or environment).SSH_AUTHORIZED_PRINCIPALS_ALLOW is set to anything.gitea --version.SSH_AUTHORIZED_PRINCIPALS_ALLOW to a restrictive value instead of anything until upgraded.SSH_TRUSTED_USER_CA_KEYS if no user certificate authority is needed.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. When Gitea trusts a user certificate authority (SSH_TRUSTED_USER_CA_KEYS) and accepts arbitrary principals (SSH_AUTHORIZED_PRINCIPALS_ALLOW=anything), a user could register another user's public key line as their own principal, or a holder of a certificate signed by that authority could list it, and then authenticate as the owner of that key through the HTTP signature API and the built-in SSH server. Instances that do not trust a user certificate authority are not affected.
This page as .md · .json · in your agent: get_signal("CVE-2026-109553")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.