GHSA-3m6q-h5gj-7mrw
Gitea has insecure default SSH settings
GHSA-3m6q-h5gj-7mrw is a medium vulnerability (CVSS 6.3) in code.gitea.io/gitea, published April 22, 2026. No source lists public exploit code. Fixed in code.gitea.io/gitea 1.25.0.
- Severity
- 6.3 MediumCVSS 4.0, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.25.0code.gitea.io/gitea
Description
Summary
The built-in SSH server currently advertises a number of key exchange, MAC, and host key algorithms that are considered weak or broken. The defaults should be tightened so a fresh installation passes a baseline SSH security audit out of the box.
Details
Running ssh-audit against a default deployment flags the following as fail:
- Key exchange
ecdh-sha2-nistp256ecdh-sha2-nistp384ecdh-sha2-nistp521
- MAC
hmac-sha1
- Host key
ssh-rsa
Reproduction
docker run -it --rm positronsecurity/ssh-audit -p 2222 gitea.local
Impact
Default deployments expose algorithms that are known-weak or deprecated upstream. The current workaround requires manually setting several GITEA__server__SSH_SERVER_* variables, which most users will never do.
Workaround
[server]
SSH_SERVER_KEY_EXCHANGES = curve25519-sha256, diffie-hellman-group14-sha256
SSH_SERVER_CIPHERS = chacha20-poly1305@openssh.com, aes128-ctr, aes192-ctr, aes256-ctr, aes128-gcm@openssh.com, aes256-gcm@openssh.com
SSH_SERVER_MACS = hmac-sha2-256-etm@openssh.com, hmac-sha2-256
There is no exposed option to restrict host key algorithms, so ssh-rsa remains advertised.
Acceptance criteria
- [ ] Default
SSH_SERVER_KEY_EXCHANGES,SSH_SERVER_CIPHERS, andSSH_SERVER_MACSupdated to the secure list above. - [ ] New
SSH_SERVER_HOST_KEY_ALGORITHMSoption added, with a default that excludesssh-rsa. - [ ] Documentation updated to reflect the new defaults.
- [ ]
ssh-auditagainst a fresh install reports no[fail]entries.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Affected packages
| Package | Affected | Fixed |
|---|---|---|
code.gitea.io/giteaGo | before 1.25.0 | 1.25.0 |
What each source reports
GitHub Advisories Score used
Gitea has insecure default SSH settings
Summary
The built-in SSH server currently advertises a number of key exchange, MAC, and host key algorithms that are considered weak or broken. The defaults should be tightened so a fresh installation passes a baseline SSH security audit out of the box.
Details
Running ssh-audit against a default deployment flags the following as fail:
- Key exchange
ecdh-sha2-nistp256ecdh-sha2-nistp384ecdh-sha2-nistp521
- MAC
hmac-sha1
- Host key
ssh-rsa
Reproduction
docker run -it --rm positronsecurity/ssh-audit -p 2222 gitea.local
Impact
Default deployments expose algorithms that are known-weak or deprecated upstream. The current workaround requires manually setting several GITEA__server__SSH_SERVER_* variables, which most users will never do.
Workaround
[server]
SSH_SERVER_KEY_EXCHANGES = curve25519-sha256, diffie-hellman-group14-sha256
SSH_SERVER_CIPHERS = chacha20-poly1305@openssh.com, aes128-ctr, aes192-ctr, aes256-ctr, aes128-gcm@openssh.com, aes256-gcm@openssh.com
SSH_SERVER_MACS = hmac-sha2-256-etm@openssh.com, hmac-sha2-256
There is no exposed option to restrict host key algorithms, so ssh-rsa remains advertised.
Acceptance criteria
- [ ] Default
SSH_SERVER_KEY_EXCHANGES,SSH_SERVER_CIPHERS, andSSH_SERVER_MACSupdated to the secure list above. - [ ] New
SSH_SERVER_HOST_KEY_ALGORITHMSoption added, with a default that excludesssh-rsa. - [ ] Documentation updated to reflect the new defaults.
- [ ]
ssh-auditagainst a fresh install reports no[fail]entries.
- Record
GHSA-3m6q-h5gj-7mrw- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-327, CWE-1188
- Updated
- 2026-11-02
OSV
Gitea has insecure default SSH settings
Summary
The built-in SSH server currently advertises a number of key exchange, MAC, and host key algorithms that are considered weak or broken. The defaults should be tightened so a fresh installation passes a baseline SSH security audit out of the box.
Details
Running ssh-audit against a default deployment flags the following as fail:
- Key exchange
ecdh-sha2-nistp256ecdh-sha2-nistp384ecdh-sha2-nistp521
- MAC
hmac-sha1
- Host key
ssh-rsa
Reproduction
docker run -it --rm positronsecurity/ssh-audit -p 2222 gitea.local
Impact
Default deployments expose algorithms that are known-weak or deprecated upstream. The current workaround requires manually setting several GITEA__server__SSH_SERVER_* variables, which most users will never do.
Workaround
[server]
SSH_SERVER_KEY_EXCHANGES = curve25519-sha256, diffie-hellman-group14-sha256
SSH_SERVER_CIPHERS = chacha20-poly1305@openssh.com, aes128-ctr, aes192-ctr, aes256-ctr, aes128-gcm@openssh.com, aes256-gcm@openssh.com
SSH_SERVER_MACS = hmac-sha2-256-etm@openssh.com, hmac-sha2-256
There is no exposed option to restrict host key algorithms, so ssh-rsa remains advertised.
Acceptance criteria
- [ ] Default
SSH_SERVER_KEY_EXCHANGES,SSH_SERVER_CIPHERS, andSSH_SERVER_MACSupdated to the secure list above. - [ ] New
SSH_SERVER_HOST_KEY_ALGORITHMSoption added, with a default that excludesssh-rsa. - [ ] Documentation updated to reflect the new defaults.
- [ ]
ssh-auditagainst a fresh install reports no[fail]entries.
- Record
GHSA-3m6q-h5gj-7mrw- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-1188, CWE-327
- Updated
- 2026-11-02
OSVGO-2026-5091No score
Gitea has insecure default SSH settings in code.gitea.io/gitea
Gitea has insecure default SSH settings in code.gitea.io/gitea
- Record
GO-2026-5091- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.