Critical severityNVD Advisory· Published Jul 3, 2026· Updated Jul 6, 2026
Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write
CVE-2026-58426
Description
Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
code.gitea.io/giteaGo | >= 1.22.0, < 1.26.2 | 1.26.2 |
Affected products
1Patches
Vulnerability mechanics
References
8- github.com/go-gitea/gitea/pull/37707ghsapatchWEB
- github.com/advisories/GHSA-hg5r-vq93-9fv6ghsaADVISORY
- github.com/go-gitea/gitea/security/advisories/GHSA-hg5r-vq93-9fv6ghsavendor-advisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-58426ghsaADVISORY
- blog.gitea.com/release-of-1.26.2ghsaWEB
- blog.gitea.com/release-of-1.26.2/mitrerelease-notes
- github.com/go-gitea/gitea/commit/1c2d5e9b03f71dd12d450b2af9a79f2557b50226ghsaWEB
- github.com/go-gitea/gitea/releases/tag/v1.26.2ghsarelease-notesWEB
News mentions
0No linked articles in our index yet.