Gitea 28.2 Fixes Nine Security Vulnerabilities, Including SSH Certificate and OpenID Account Takeovers

Gitea 28.2 Fixes Nine Security Vulnerabilities, Including SSH Certificate and OpenID Account Takeovers

By Our editorial standards

Gitea released version 28.2 on October 18, the second maintenance update since Gitea 28.0 dropped the 1.x numbering. It fixes nine security vulnerabilities, and the project strongly recommends upgrading as soon as possible.

The serious ones

  • CVE-2026-109553, SSH authentication: certificate principals were not validated properly, so under certain configurations an attacker could authenticate as another user. This matters if you use SSH certificates with Gitea
  • CVE-2026-104627, OpenID: an attacker could link their own OpenID identity to someone else’s account and sign in as them. Linking now requires a short-lived state value tied to the logged-in user
  • CVE-2026-110311: attachments from private repositories could be exposed through draft releases
  • CVE-2026-105964: the Actions artifact v4 API accepted unlimited request sizes, so a request could exhaust server memory. Bodies are now capped at 1MiB

Other fixes cover unauthorised interaction with locked issues, attachment permissions, and cross-site request forgery on repository topics. Gitea also disclosed three issues fixed in earlier releases.

Other fixes

Cancelled reusable workflows no longer get stuck, scheduled workflows follow default branch changes, empty pull requests are no longer marked as merged, and WebAuthn works better with WebKit browsers.

Upgrade

Gitea is a single binary, so upgrading means replacing it and restarting the service after a backup. Binaries are on our Gitea 28.2 download page; for containers, pull gitea/gitea:28.2. If your instance is exposed to the internet and uses SSH certificates or OpenID sign-in, treat this as urgent.

More news

Gitea Jumps From 1.x to 28.0 and Adds Audit Logs, Bot Accounts, and Admin ImpersonationGitea drops its 1.x version scheme and ships 28.0 with security audit logging, token-only bot accounts, admin impersonation for troubleshooting, CODEOWNERS approvals, and several breaking changes to check before upgrading.Forgejo 17.0 Adds Actions Job Summaries, Workflow Webhooks, and Better Git LFS ManagementForgejo 17.0 brings Markdown job summaries and a richer Actions API, new workflow and job webhooks, improved Git LFS browsing, FUNDING.yml donate buttons, and Bitbucket Data Center migration. It is a short-term release supported until January 2027.Dovecot 2.4.5 Fixes 18 CVEsThe most widely deployed IMAP server has shipped a release addressing eighteen security vulnerabilities, alongside a new phrase search feature.

Background reading

Explainers for the concepts behind this story.

Malware Scanning on Linux: ClamAV, rkhunter, and Lynis ComparedThree different tools that are often lumped together as Linux antivirus. What ClamAV, rkhunter, chkrootkit, and Lynis each actually detect, how to run them, how to read their false positives, and when scanning is worth it.Hardening systemd Services: The Directives That Actually ConfineProtectSystem, PrivateTmp, NoNewPrivileges, and the rest, what each one blocks, and how to use systemd-analyze security to find out how exposed your services are right now.The First Ten Minutes on a New Linux ServerA fresh VPS is reachable from the entire internet within seconds of provisioning. Here is the short, ordered list of things to do before you install anything else.