Live › vulnerability › CVE-2026-119545
Forgejo's OpenID login accepts arbitrary identifier URLs and fetches them from the server, so an unauthenticated attacker can make it send requests to loopback, cloud metadata and internal hosts. The attacker gets blind probing and port scanning of the internal network, which can reveal internal services and metadata-reachable secrets.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Self-hosted Forgejo instances in the affected version ranges that allow OpenID sign-in are exposed, because the login endpoint fetches attacker-supplied URLs without restriction. Instances without OpenID login enabled, or running a version outside these ranges, can skip this. unknown for whether hosted or managed Forgejo deployments are patched.
No product ranges from the sources yet.
forgejo --version or the admin dashboard, and compare it to the affected ranges.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server issue requests by submitting arbitrary OpenID identifier URLs. Attackers can POST crafted identifiers to /user/login/openid to trigger blind discovery GET requests to loopback, cloud metadata, and internal addresses for port scanning and probing.
This page as .md · .json · in your agent: get_signal("CVE-2026-119545")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.