{"id":"CVE-2026-103059","published":"2026-10-06T20:17:14Z","modified":"2026-10-15T02:26:26Z","title":"When Gitea's built-in SSH server is enabled (`START_SSH_SERVER = true`), the presented public key was looked up with…","vendor":"Gitea","product":"Gitea","tier":"core","eol":null,"description":{"text":"When Gitea's built-in SSH server is enabled (`START_SSH_SERVER = true`), the presented public key was looked up with an SQL `LIKE` comparison of its encoded content, which is case-insensitive on some databases, including the default SQLite. An attacker who can construct a case variant of another user's registered RSA public key for which they can derive the private key could have that key matched to the victim's account and authenticate over SSH as that user. Keys are now looked up by fingerprint.","provenance":"source","from":"NVD"},"summary":{"text":"Gitea's built-in SSH server, when enabled (START_SSH_SERVER = true), matched presented public keys by an SQL LIKE comparison of their encoded content, which is case-insensitive on some databases including the default SQLite. An attacker who can present a case variant of another user's registered RSA public key, and who can derive the corresponding private key, can authenticate over SSH as that user, with no authentication or user interaction required beforehand.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:21:26Z"},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.00391,"percentile":0.33249,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":null,"cwes":[{"id":"CWE-305","name":"Authentication Bypass by Primary Weakness"}],"references":[{"url":"https://blog.gitea.com/release-of-28.0.0/","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/pull/39423","tags":["Patch","Issue Tracking"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","tags":["Release Notes"]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-8pwg-hcgm-54cp","tags":["Vendor Advisory"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-93906","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-93906","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-06","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103059","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":13.0,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":6.65,"detail":"percentile 0.3325"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.37,"detail":"base score 9.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}