CVE-2026-101029

Katalog CVE KUTIM-CSIRT

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2026-101029

Katalog CVE

CVSS 4.3 · Medium EPSS 0,17%

Kerentanan Generation of Error Message Containing Sensitive Information. Skor CVSS 3.1 4.3 (Medium) menurut CISA ADP.

Deskripsi (NVD)

Gitea's repository migration and pull mirror egress checks could be bypassed with a hostname that returns multiple DNS answers, because the address that was validated was not necessarily the address Git later connected to. A low-privileged user who can create migrations or mirrors could direct the server to internal services, reading from and writing to reachable internal Git or HTTP endpoints. Content from internal responses could additionally be disclosed through migration and mirror error messages.

Rincian

Terbit di NVD
6 Oktober 2026
Terakhir diubah
7 Oktober 2026
Status NVD
Awaiting Analysis
CVSS 3.1
4.3 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-209: Generation of Error Message Containing Sensitive Information
CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
CWE-918: Server-Side Request Forgery (SSRF)
EPSS (30 hari)
0,17% peluang dieksploitasi; lebih tinggi dari 5,9% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 8 Okt 2026, 12:26 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.