{"id":"CVE-2026-58426","aliases":["EUVD-2026-41608","GHSA-hg5r-vq93-9fv6","GO-2026-6060","SUSE-SU-2026:23216-1","SUSE-SU-2026:23227-1","openSUSE-SU-2026:21551-1"],"status":"published","title":"Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write","description":"Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write","severity":{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00233,"percentile":0.14371,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-347"],"published":"2026-07-03T20:54:53Z","modified":"2026-10-28T02:31:06Z","fixes":[{"ecosystem":"Go","package":"code.gitea.io/gitea","fixed_in":["1.26.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"code.gitea.io/gitea","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.22.0"},{"fixed":"1.26.2"}]}]},{"source":"osv","ecosystem":"Go","package":"code.gitea.io/gitea","ranges":[{"type":"SEMVER","events":[{"introduced":"1.22.0"},{"fixed":"1.26.2"}]}]},{"source":"osv","ecosystem":"Go","package":"code.gitea.io/gitea","ranges":[{"type":"SEMVER","events":[{"introduced":"1.22.0"},{"fixed":"1.26.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260727T201416-160000.1.1"}]}],"bundled":77},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260727T201416-160000.1.1"}]}],"bundled":77},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260727T201416-160000.1.1"}]}],"bundled":77},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260727T201416-160000.1.1"}]}],"bundled":77},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260727T201416-160000.1.1"}]}],"bundled":77}],"products":[{"vendor":"gitea","product":"gitea open source git server"}],"references":[{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-hg5r-vq93-9fv6","tags":["vendor-advisory","exploit","advisory","web"]},{"url":"https://github.com/go-gitea/gitea/pull/37707","tags":["patch","fix","web"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.26.2","tags":["release-notes","advisory","web"]},{"url":"https://blog.gitea.com/release-of-1.26.2/","tags":["release-notes","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58426","tags":["advisory"]},{"url":"https://github.com/go-gitea/gitea/commit/1c2d5e9b03f71dd12d450b2af9a79f2557b50226","tags":["web"]},{"url":"https://blog.gitea.com/release-of-1.26.2","tags":["web"]},{"url":"https://github.com/advisories/GHSA-hg5r-vq93-9fv6"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58426.json","tags":["advisory"]},{"url":"https://github.com/go-gitea/gitea","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623216-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24451","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-30246","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-37462","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40611","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41642","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41643","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42306","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42328","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42554","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44301","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44332","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44517","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46384","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46385","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49837","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49838","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50274","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52844","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52845","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-52846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53624","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55987","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58417","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58418","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58421","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58426","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58427","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58431","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58432","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58435","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58438","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58439","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58441","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58442","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58443","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58507","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58510","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6993","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7482","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8276","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623227-1/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-58426","title":"Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write","description":"Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write","status":"published","published":"2026-07-03T20:54:53.283Z","modified":"2026-07-06T15:07:18.21Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical","assessor":"cna"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T13:47:28.691429Z"}],"euvd":[{"id":"EUVD-2026-41608","description":"Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write","status":"published","published":"2026-07-03T20:54:53Z","modified":"2026-07-06T15:07:18Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T18:20:13.172179Z"}],"ghsa":[{"id":"GHSA-hg5r-vq93-9fv6","title":"Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write","description":"### Summary\n\nGitea Actions Artifacts V4 signed upload/download URLs can be rewritten to access a different running task and repository context while preserving the original HMAC signature. An attacker with permission to run a Gitea Actions job can turn a signed URL for an attacker-controlled artifact into a URL that reads artifacts from another task context, or writes attacker-controlled data into another task's artifact upload staging context, including in a private repository.\n\nThis is one vulnerability with two exploit paths:\n\n- `DownloadArtifact`: cross-task/cross-repository artifact read, giving `C:H`.\n- `UploadArtifact`: cross-task artifact staging write and metadata mutation, giving `I:H`.\n\n### Details\n\nThe root cause is that the V4 artifact signed URL signature is built from raw concatenated fields without delimiters or length-prefixing:\n\n```go\nfunc (r *artifactV4Routes) buildSignature(endpoint, expires, artifactName string, taskID, artifactID int64) []byte {\n        mac := hmac.New(sha256.New, setting.GetGeneralTokenSigningSecret())\n        mac.Write([]byte(endpoint))\n        mac.Write([]byte(expires))\n        mac.Write([]byte(artifactName))\n        _, _ = fmt.Fprint(mac, taskID)\n        _, _ = fmt.Fprint(mac, artifactID)\n        return mac.Sum(nil)\n}\n```\n\nAffected code: `routers/api/actions/artifactsv4.go:164-171`.\n\nBecause `artifactName`, `taskID`, and `artifactID` are concatenated without boundaries, two different URL tuples can produce the same HMAC input. For example:\n\n```text\nsigned tuple:\nartifactName = \"artifact-795-153\"\ntaskID       = 48\nartifactID   = \u003cattacker artifact id\u003e\n\nforged tuple:\nartifactName = \"artifact-795-1\"\ntaskID       = 53\nartifactID   = 48\u003cattacker artifact id\u003e\n```\n\nThe final HMAC input suffix is identical:\n\n```text\nartifact-795-15348\u003cattacker artifact id\u003e\n```\n\nThe attacker does not need to know the target artifact's database `artifactID`. The forged URL's `artifactID` only needs to carry digits that preserve the original HMAC input. After verification, the actual target artifact is looked up by target task/run/attempt and `artifactName`, not by the signed `artifactID`.\n\nThe signed URL handlers are unauthenticated and use `ArtifactV4Contexter()` only:\n\n```go\nm.Group(\"\", func() {\n        m.Put(\"UploadArtifact\", r.uploadArtifact)\n        m.Get(\"DownloadArtifact\", r.downloadArtifact)\n}, ArtifactV4Contexter())\n```\n\nAffected code: `routers/api/actions/artifactsv4.go:156-159`.\n\nAfter verifying the HMAC, `verifySignature()` trusts the URL-controlled `taskID`, loads that task, checks that it is running, and returns the URL-controlled `artifactName`. It parses `artifactID` for the HMAC, but does not load or bind the artifact by that signed artifact ID:\n\n```go\ntask, err := actions_model.GetTaskByID(ctx, taskID)\n...\nif task.Status != actions_model.StatusRunning {\n        ...\n}\n...\nreturn task, artifactName, true\n```\n\nAffected code: `routers/api/actions/artifactsv4.go:224-267`.\n\nThe artifact lookup then uses the URL-selected task's run/attempt plus URL-selected artifact name:\n\n```go\nhas, err := db.GetEngine(ctx).Where(builder.Eq{\n        \"run_id\": runID,\n        \"run_attempt_id\": runAttemptID,\n        \"artifact_name\": name,\n}, builder.Like{\"content_encoding\", \"%/%\"}).Get(\u0026art)\n```\n\nAffected code: `routers/api/actions/artifactsv4.go:270-278`.\n\nFor download, the forged URL reaches `downloadArtifact()`, which verifies the signature, resolves the artifact by the forged task/run/name context, and serves it:\n\n```go\ntask, artifactName, ok := r.verifySignature(ctx, \"DownloadArtifact\")\n...\nartifact, err := r.getArtifactByName(ctx, task.Job.RunID, task.Job.RunAttemptID, artifactName)\n...\nerr = actions.DownloadArtifactV4ReadStorage(ctx.Base, artifact)\n```\n\nAffected code: `routers/api/actions/artifactsv4.go:674-693`.\n\nFor upload, the forged URL reaches `uploadArtifact()`, which verifies the signature, resolves the target artifact by the forged task/run/name context, appends attacker-controlled data, and updates target artifact metadata:\n\n```go\ntask, artifactName, ok := r.verifySignature(ctx, \"UploadArtifact\")\n...\nartifact, err := r.getArtifactByName(ctx, task.Job.RunID, task.Job.RunAttemptID, artifactName)\n...\nuploadedLength, err := appendUploadChunkV3(r.fs, ctx, artifact, artifact.RunID, artifact.FileSize)\n...\nartifact.FileCompressedSize += uploadedLength\nartifact.FileSize += uploadedLength\n...\nactions_model.UpdateArtifactByID(ctx, artifact.ID, artifact)\n```\n\nAffected code: `routers/api/actions/artifactsv4.go:382-422`.\n\nThe strengthened dynamic PoC also opens the storage object created by the forged upload and verifies that the attacker-controlled bytes were written under the target run and target artifact ID staging path. This demonstrates an unauthorized write primitive into the target artifact upload context. The current PoC does not claim that a finalized artifact download already serves modified bytes; for the integrity path, the confirmed impact is cross-context staging write plus target artifact metadata mutation. In normal artifact upload flow, data in this staging area is what `FinalizeArtifact` later consumes.\n\nV4 artifact creation also appears to omit the existing artifact-name validation:\n\n```go\nartifactName := req.Name\n...\nartifact, err := actions_model.CreateArtifact(ctx, ctx.ActionTask, artifactName, fileName, retentionDays)\n```\n\nAffected code: `routers/api/actions/artifactsv4.go:309-337`.\n\nThis is a hardening issue, but it is not required for the demonstrated tuple-boundary collision. The crafted artifact names in the PoC use ordinary characters such as letters, digits, and hyphens that would normally be valid. The root cause is the ambiguous signed payload plus the post-verification lookup by URL-selected task/run/name context.\n\nThe target task must be running, but that is the normal validity window of these signed URLs. The exploit itself is a deterministic parameter rewrite against the active artifact URL flow, so `AC:L` is appropriate.\n\nEven if the integrity impact is scored conservatively, the `DownloadArtifact` path independently demonstrates cross-repository private artifact disclosure.\n\nPractical constraints:\n\n- the target task must be in `running` state;\n- the target task ID and artifact name must be known or predictable;\n- for `DownloadArtifact` on newer branches, the target artifact must already be `UploadConfirmed` while the target task is still running. Older V4 implementations differ slightly in artifact lookup/status handling; the PoC validates the branch-specific condition used by each tested release;\n- the forged decimal `artifactID` must parse as `int64`;\n- the exact storage effect depends on the configured artifact storage backend. The local PoC uses the default non-Azure storage path. The root cause still exists before storage backend handling because the signed URL context is confused before upload/download dispatch.\n- the demonstrated exploit applies when Gitea issues its own V4 `UploadArtifact`/`DownloadArtifact` signed URLs. Storage backends or configurations that return direct backend URLs should be assessed separately, because they may bypass these Gitea signed URL handlers.\n\n### PoC\n\nTested against Gitea `main` checkout:\n\n```text\n6a270662690439cabe8582e92c22b04d1f8a3fe9\n```\n\nVerified affected versions tested locally:\n\n```text\nmain       6a27066269  reproduced dynamically\nv1.26.1    afdbd9b7c5  reproduced dynamically\nv1.25.5    f913d90ab6  reproduced dynamically\nv1.24.7    99053ce4fa  reproduced dynamically\nv1.23.8    cccd54999a  reproduced dynamically\nv1.22.6    8eefa1f6de  reproduced dynamically with Go 1.22.12 test toolchain\nv1.21.11   V4 artifactsv4.go route not present in routers/api/actions; not affected by this V4 signed URL path as tested\n```\n\nUnless otherwise noted, the affected code snippets and line numbers above refer to the tested `main` checkout `6a27066269`. Older release branches contain the same vulnerable signed URL construction and post-verification context confusion, but line numbers and artifact lookup details differ slightly between releases. For example, newer code includes `run_attempt_id` in the artifact lookup, while older V4 implementations look up by run/name/path/content-encoding. These differences do not affect the demonstrated HMAC boundary-collision primitive.\n\nFor `main`, `v1.26.1`, and `v1.25.5`, the PoC uses the private `user2/repo2` fixture and demonstrates cross-repository artifact read. For `v1.24.7`, `v1.23.8`, and `v1.22.6`, the compatible test fixtures differ, so the portable PoC demonstrates the same signed URL rewrite across task/run contexts; `v1.22.6` creates the target artifact inside the test because that release does not include the newer artifact fixture file.\n\nThe private-repository disclosure impact is demonstrated on releases with suitable private repository fixtures; on older fixtures, the portable test confirms the same cross-context signed URL rewrite primitive, which applies to private targets under the same running-task and known-identifier conditions. The PoC was adapted per release only to account for fixture and test-toolchain differences; the exploit primitive is the same signed URL tuple rewrite.\n\nLocal test environment:\n\n- Gitea integration test environment.\n- Default local Actions artifact storage, not Azure direct upload.\n- Existing fixture tasks/artifacts from Gitea's test fixtures.\n- The dynamic PoC sets the target task status to `running` before exploiting the URL, matching the vulnerable signed URL requirement.\n\nRun:\n\n```bash\ncd /home/kali/gitea/pocs\nGITEA_REPO=/home/kali/gitea/repo GOTOOLCHAIN=auto go run ./actions_artifact_v4_cross_task_access_dynamic_poc.go\n```\n\nThe dynamic PoC writes a temporary integration test into the Gitea checkout, runs only that test, and removes the temporary test afterward.\n\nThe test uses:\n\n```text\nattacker task: 48\nattacker run: 792\nattacker job: 193\nattacker repository id: 4\n\ntarget task: 53\ntarget run: 795\ntarget job: 198\ntarget repository: user2/repo2, repository id 2\ntarget artifact: artifact-795-1\ncrafted attacker artifact: artifact-795-153\n```\n\nPoC flow:\n\n1. Create an Actions authorization token for attacker task `48`.\n2. Verify the attacker token cannot request a signed URL for target run `795` through the authenticated Twirp API.\n3. Create an attacker-controlled V4 artifact named `artifact-795-153`.\n4. Upload and finalize that attacker artifact to obtain a legitimate signed URL.\n5. Rewrite the signed download URL:\n\n```text\nartifactName=artifact-795-1\ntaskID=53\nartifactID=48\u003cattackerArtifactID\u003e\n```\n\n6. Send the forged final `GET` without any token and receive the private target artifact from `user2/repo2`.\n7. Rewrite the signed upload URL in the same way.\n8. Send a forged `PUT ...\u0026comp=appendBlock` with attacker-controlled data.\n9. Confirm the target artifact metadata was changed by the forged upload.\n10. Open the target run/artifact staging chunk from storage and confirm it contains the attacker-controlled bytes.\n\nObserved output:\n\n```text\nsource=/home/kali/gitea/repo\nok      code.gitea.io/gitea/tests/integration   9.069s\nreproduced: attacker task cannot request a target-run signed URL through the authenticated Twirp method\nreproduced: attacker-created V4 signed URL keeps its HMAC after taskID/artifactName/artifactID rewrite\nreproduced: unauthenticated final GET returns the URL-selected target artifact instead of attacker content\nreproduced: forged UploadArtifact URL writes attacker-controlled bytes into target run/artifact staging storage and changes target artifact metadata\ncondition=attacker can run a Gitea Actions task and target task/artifact identifiers are known while target task is running\ncvss_candidate=CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N\n```\n\nExample version test commands:\n\n```bash\ncd /home/kali/gitea/pocs\nGITEA_REPO=/home/kali/gitea/version-tests/gitea-v1.26.1 go run ./actions_artifact_v4_cross_task_access_dynamic_poc.go\nGITEA_REPO=/home/kali/gitea/version-tests/gitea-v1.25.5 go run ./actions_artifact_v4_cross_task_access_dynamic_poc.go\nGITEA_REPO=/home/kali/gitea/version-tests/gitea-v1.24.7 go run ./actions_artifact_v4_cross_task_access_dynamic_poc.go\nGITEA_REPO=/home/kali/gitea/version-tests/gitea-v1.23.8 go run ./actions_artifact_v4_cross_task_access_dynamic_poc.go\nGITEA_REPO=/home/kali/gitea/version-tests/gitea-v1.22.6 GITEA_TEST_GOTOOLCHAIN=go1.22.12 go run ./actions_artifact_v4_cross_task_access_dynamic_poc.go\n```\n\nSome release worktrees require a local `gitea` binary before integration tests run:\n\n```bash\ncd /path/to/gitea-release-worktree\ngo build -tags 'sqlite sqlite_unlock_notify' -o gitea .\n```\n\n### Impact\n\nThis is a cross-task and cross-repository authorization bypass in Gitea Actions artifact handling.\n\nAn attacker who can run an Actions job can obtain a valid V4 artifact signed URL for their own task, rewrite it without invalidating the HMAC, and make the server operate in another running task's context.\n\nImpacted users are Gitea instances with Actions enabled and V4 artifact signed URL handling in use. Private repositories are impacted because the forged signed URL handlers do not re-check repository access after reconstructing task context from URL parameters.\n\nConfirmed impact:\n\n- Confidentiality: read artifacts from a target running task in a private repository.\n- Integrity: write attacker-controlled artifact data into the target run/artifact staging storage and mutate target artifact metadata.\n\nThis can expose build outputs, logs or packaged artifacts stored as workflow artifacts, and can interfere with in-flight artifact upload staging. Depending on the target upload/finalization flow, it may poison artifact data consumed by later workflow steps, release automation, deployment jobs, or downstream users.\n\nRecommended fix:\n\n- Sign a canonical structured payload, such as JSON/protobuf or length-prefixed fields, instead of concatenating raw values. A versioned payload is preferable, for example `HMAC(version || canonical_payload)`.\n- Include and enforce endpoint, expiry, task ID, artifact ID, artifact name, run ID, run attempt ID, repository ID, and owner ID in the signed payload.\n- After signature verification, load the artifact by signed `artifactID`.\n- Reject the request unless the signed artifact ID, task ID, run ID, run attempt ID, repository ID, owner ID, and artifact name all match.\n- Apply artifact-name validation to V4 artifact creation as hardening.\n\nAdding separators alone is not a complete fix if the post-verification code still trusts URL fields and looks up the artifact only by name/run context. Artifact-name validation is also hardening rather than a root-cause fix, because normal valid artifact names can contain digits and separators. The important security property is binding the signed URL to one canonical artifact, task, run, repository, owner, endpoint, and expiry.","status":"published","published":"2026-07-21T20:36:38Z","modified":"2026-07-21T20:36:41Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:40:50.444681Z"}],"nvd":[{"id":"CVE-2026-58426","description":"Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write","status":"published","published":"2026-07-03T21:17:05.77Z","modified":"2026-10-25T15:10:00.147Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:12:27.541515Z"}],"osv":[{"id":"CVE-2026-58426","title":"Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write","description":"Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write","status":"published","published":"2026-07-03T20:54:53.283Z","modified":"2026-10-28T02:31:06.431405827Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:45:12.496548Z"},{"id":"GHSA-hg5r-vq93-9fv6","title":"Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write","description":"### Summary\n\nGitea Actions Artifacts V4 signed upload/download URLs can be rewritten to access a different running task and repository context while preserving the original HMAC signature. An attacker with permission to run a Gitea Actions job can turn a signed URL for an attacker-controlled artifact into a URL that reads artifacts from another task context, or writes attacker-controlled data into another task's artifact upload staging context, including in a private repository.\n\nThis is one vulnerability with two exploit paths:\n\n- `DownloadArtifact`: cross-task/cross-repository artifact read, giving `C:H`.\n- `UploadArtifact`: cross-task artifact staging write and metadata mutation, giving `I:H`.\n\n### Details\n\nThe root cause is that the V4 artifact signed URL signature is built from raw concatenated fields without delimiters or length-prefixing:\n\n```go\nfunc (r *artifactV4Routes) buildSignature(endpoint, expires, artifactName string, taskID, artifactID int64) []byte {\n        mac := hmac.New(sha256.New, setting.GetGeneralTokenSigningSecret())\n        mac.Write([]byte(endpoint))\n        mac.Write([]byte(expires))\n        mac.Write([]byte(artifactName))\n        _, _ = fmt.Fprint(mac, taskID)\n        _, _ = fmt.Fprint(mac, artifactID)\n        return mac.Sum(nil)\n}\n```\n\nAffected code: `routers/api/actions/artifactsv4.go:164-171`.\n\nBecause `artifactName`, `taskID`, and `artifactID` are concatenated without boundaries, two different URL tuples can produce the same HMAC input. For example:\n\n```text\nsigned tuple:\nartifactName = \"artifact-795-153\"\ntaskID       = 48\nartifactID   = \u003cattacker artifact id\u003e\n\nforged tuple:\nartifactName = \"artifact-795-1\"\ntaskID       = 53\nartifactID   = 48\u003cattacker artifact id\u003e\n```\n\nThe final HMAC input suffix is identical:\n\n```text\nartifact-795-15348\u003cattacker artifact id\u003e\n```\n\nThe attacker does not need to know the target artifact's database `artifactID`. The forged URL's `artifactID` only needs to carry digits that preserve the original HMAC input. After verification, the actual target artifact is looked up by target task/run/attempt and `artifactName`, not by the signed `artifactID`.\n\nThe signed URL handlers are unauthenticated and use `ArtifactV4Contexter()` only:\n\n```go\nm.Group(\"\", func() {\n        m.Put(\"UploadArtifact\", r.uploadArtifact)\n        m.Get(\"DownloadArtifact\", r.downloadArtifact)\n}, ArtifactV4Contexter())\n```\n\nAffected code: `routers/api/actions/artifactsv4.go:156-159`.\n\nAfter verifying the HMAC, `verifySignature()` trusts the URL-controlled `taskID`, loads that task, checks that it is running, and returns the URL-controlled `artifactName`. It parses `artifactID` for the HMAC, but does not load or bind the artifact by that signed artifact ID:\n\n```go\ntask, err := actions_model.GetTaskByID(ctx, taskID)\n...\nif task.Status != actions_model.StatusRunning {\n        ...\n}\n...\nreturn task, artifactName, true\n```\n\nAffected code: `routers/api/actions/artifactsv4.go:224-267`.\n\nThe artifact lookup then uses the URL-selected task's run/attempt plus URL-selected artifact name:\n\n```go\nhas, err := db.GetEngine(ctx).Where(builder.Eq{\n        \"run_id\": runID,\n        \"run_attempt_id\": runAttemptID,\n        \"artifact_name\": name,\n}, builder.Like{\"content_encoding\", \"%/%\"}).Get(\u0026art)\n```\n\nAffected code: `routers/api/actions/artifactsv4.go:270-278`.\n\nFor download, the forged URL reaches `downloadArtifact()`, which verifies the signature, resolves the artifact by the forged task/run/name context, and serves it:\n\n```go\ntask, artifactName, ok := r.verifySignature(ctx, \"DownloadArtifact\")\n...\nartifact, err := r.getArtifactByName(ctx, task.Job.RunID, task.Job.RunAttemptID, artifactName)\n...\nerr = actions.DownloadArtifactV4ReadStorage(ctx.Base, artifact)\n```\n\nAffected code: `routers/api/actions/artifactsv4.go:674-693`.\n\nFor upload, the forged URL reaches `uploadArtifact()`, which verifies the signature, resolves the target artifact by the forged task/run/name context, appends attacker-controlled data, and updates target artifact metadata:\n\n```go\ntask, artifactName, ok := r.verifySignature(ctx, \"UploadArtifact\")\n...\nartifact, err := r.getArtifactByName(ctx, task.Job.RunID, task.Job.RunAttemptID, artifactName)\n...\nuploadedLength, err := appendUploadChunkV3(r.fs, ctx, artifact, artifact.RunID, artifact.FileSize)\n...\nartifact.FileCompressedSize += uploadedLength\nartifact.FileSize += uploadedLength\n...\nactions_model.UpdateArtifactByID(ctx, artifact.ID, artifact)\n```\n\nAffected code: `routers/api/actions/artifactsv4.go:382-422`.\n\nThe strengthened dynamic PoC also opens the storage object created by the forged upload and verifies that the attacker-controlled bytes were written under the target run and target artifact ID staging path. This demonstrates an unauthorized write primitive into the target artifact upload context. The current PoC does not claim that a finalized artifact download already serves modified bytes; for the integrity path, the confirmed impact is cross-context staging write plus target artifact metadata mutation. In normal artifact upload flow, data in this staging area is what `FinalizeArtifact` later consumes.\n\nV4 artifact creation also appears to omit the existing artifact-name validation:\n\n```go\nartifactName := req.Name\n...\nartifact, err := actions_model.CreateArtifact(ctx, ctx.ActionTask, artifactName, fileName, retentionDays)\n```\n\nAffected code: `routers/api/actions/artifactsv4.go:309-337`.\n\nThis is a hardening issue, but it is not required for the demonstrated tuple-boundary collision. The crafted artifact names in the PoC use ordinary characters such as letters, digits, and hyphens that would normally be valid. The root cause is the ambiguous signed payload plus the post-verification lookup by URL-selected task/run/name context.\n\nThe target task must be running, but that is the normal validity window of these signed URLs. The exploit itself is a deterministic parameter rewrite against the active artifact URL flow, so `AC:L` is appropriate.\n\nEven if the integrity impact is scored conservatively, the `DownloadArtifact` path independently demonstrates cross-repository private artifact disclosure.\n\nPractical constraints:\n\n- the target task must be in `running` state;\n- the target task ID and artifact name must be known or predictable;\n- for `DownloadArtifact` on newer branches, the target artifact must already be `UploadConfirmed` while the target task is still running. Older V4 implementations differ slightly in artifact lookup/status handling; the PoC validates the branch-specific condition used by each tested release;\n- the forged decimal `artifactID` must parse as `int64`;\n- the exact storage effect depends on the configured artifact storage backend. The local PoC uses the default non-Azure storage path. The root cause still exists before storage backend handling because the signed URL context is confused before upload/download dispatch.\n- the demonstrated exploit applies when Gitea issues its own V4 `UploadArtifact`/`DownloadArtifact` signed URLs. Storage backends or configurations that return direct backend URLs should be assessed separately, because they may bypass these Gitea signed URL handlers.\n\n### PoC\n\nTested against Gitea `main` checkout:\n\n```text\n6a270662690439cabe8582e92c22b04d1f8a3fe9\n```\n\nVerified affected versions tested locally:\n\n```text\nmain       6a27066269  reproduced dynamically\nv1.26.1    afdbd9b7c5  reproduced dynamically\nv1.25.5    f913d90ab6  reproduced dynamically\nv1.24.7    99053ce4fa  reproduced dynamically\nv1.23.8    cccd54999a  reproduced dynamically\nv1.22.6    8eefa1f6de  reproduced dynamically with Go 1.22.12 test toolchain\nv1.21.11   V4 artifactsv4.go route not present in routers/api/actions; not affected by this V4 signed URL path as tested\n```\n\nUnless otherwise noted, the affected code snippets and line numbers above refer to the tested `main` checkout `6a27066269`. Older release branches contain the same vulnerable signed URL construction and post-verification context confusion, but line numbers and artifact lookup details differ slightly between releases. For example, newer code includes `run_attempt_id` in the artifact lookup, while older V4 implementations look up by run/name/path/content-encoding. These differences do not affect the demonstrated HMAC boundary-collision primitive.\n\nFor `main`, `v1.26.1`, and `v1.25.5`, the PoC uses the private `user2/repo2` fixture and demonstrates cross-repository artifact read. For `v1.24.7`, `v1.23.8`, and `v1.22.6`, the compatible test fixtures differ, so the portable PoC demonstrates the same signed URL rewrite across task/run contexts; `v1.22.6` creates the target artifact inside the test because that release does not include the newer artifact fixture file.\n\nThe private-repository disclosure impact is demonstrated on releases with suitable private repository fixtures; on older fixtures, the portable test confirms the same cross-context signed URL rewrite primitive, which applies to private targets under the same running-task and known-identifier conditions. The PoC was adapted per release only to account for fixture and test-toolchain differences; the exploit primitive is the same signed URL tuple rewrite.\n\nLocal test environment:\n\n- Gitea integration test environment.\n- Default local Actions artifact storage, not Azure direct upload.\n- Existing fixture tasks/artifacts from Gitea's test fixtures.\n- The dynamic PoC sets the target task status to `running` before exploiting the URL, matching the vulnerable signed URL requirement.\n\nRun:\n\n```bash\ncd /home/kali/gitea/pocs\nGITEA_REPO=/home/kali/gitea/repo GOTOOLCHAIN=auto go run ./actions_artifact_v4_cross_task_access_dynamic_poc.go\n```\n\nThe dynamic PoC writes a temporary integration test into the Gitea checkout, runs only that test, and removes the temporary test afterward.\n\nThe test uses:\n\n```text\nattacker task: 48\nattacker run: 792\nattacker job: 193\nattacker repository id: 4\n\ntarget task: 53\ntarget run: 795\ntarget job: 198\ntarget repository: user2/repo2, repository id 2\ntarget artifact: artifact-795-1\ncrafted attacker artifact: artifact-795-153\n```\n\nPoC flow:\n\n1. Create an Actions authorization token for attacker task `48`.\n2. Verify the attacker token cannot request a signed URL for target run `795` through the authenticated Twirp API.\n3. Create an attacker-controlled V4 artifact named `artifact-795-153`.\n4. Upload and finalize that attacker artifact to obtain a legitimate signed URL.\n5. Rewrite the signed download URL:\n\n```text\nartifactName=artifact-795-1\ntaskID=53\nartifactID=48\u003cattackerArtifactID\u003e\n```\n\n6. Send the forged final `GET` without any token and receive the private target artifact from `user2/repo2`.\n7. Rewrite the signed upload URL in the same way.\n8. Send a forged `PUT ...\u0026comp=appendBlock` with attacker-controlled data.\n9. Confirm the target artifact metadata was changed by the forged upload.\n10. Open the target run/artifact staging chunk from storage and confirm it contains the attacker-controlled bytes.\n\nObserved output:\n\n```text\nsource=/home/kali/gitea/repo\nok      code.gitea.io/gitea/tests/integration   9.069s\nreproduced: attacker task cannot request a target-run signed URL through the authenticated Twirp method\nreproduced: attacker-created V4 signed URL keeps its HMAC after taskID/artifactName/artifactID rewrite\nreproduced: unauthenticated final GET returns the URL-selected target artifact instead of attacker content\nreproduced: forged UploadArtifact URL writes attacker-controlled bytes into target run/artifact staging storage and changes target artifact metadata\ncondition=attacker can run a Gitea Actions task and target task/artifact identifiers are known while target task is running\ncvss_candidate=CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N\n```\n\nExample version test commands:\n\n```bash\ncd /home/kali/gitea/pocs\nGITEA_REPO=/home/kali/gitea/version-tests/gitea-v1.26.1 go run ./actions_artifact_v4_cross_task_access_dynamic_poc.go\nGITEA_REPO=/home/kali/gitea/version-tests/gitea-v1.25.5 go run ./actions_artifact_v4_cross_task_access_dynamic_poc.go\nGITEA_REPO=/home/kali/gitea/version-tests/gitea-v1.24.7 go run ./actions_artifact_v4_cross_task_access_dynamic_poc.go\nGITEA_REPO=/home/kali/gitea/version-tests/gitea-v1.23.8 go run ./actions_artifact_v4_cross_task_access_dynamic_poc.go\nGITEA_REPO=/home/kali/gitea/version-tests/gitea-v1.22.6 GITEA_TEST_GOTOOLCHAIN=go1.22.12 go run ./actions_artifact_v4_cross_task_access_dynamic_poc.go\n```\n\nSome release worktrees require a local `gitea` binary before integration tests run:\n\n```bash\ncd /path/to/gitea-release-worktree\ngo build -tags 'sqlite sqlite_unlock_notify' -o gitea .\n```\n\n### Impact\n\nThis is a cross-task and cross-repository authorization bypass in Gitea Actions artifact handling.\n\nAn attacker who can run an Actions job can obtain a valid V4 artifact signed URL for their own task, rewrite it without invalidating the HMAC, and make the server operate in another running task's context.\n\nImpacted users are Gitea instances with Actions enabled and V4 artifact signed URL handling in use. Private repositories are impacted because the forged signed URL handlers do not re-check repository access after reconstructing task context from URL parameters.\n\nConfirmed impact:\n\n- Confidentiality: read artifacts from a target running task in a private repository.\n- Integrity: write attacker-controlled artifact data into the target run/artifact staging storage and mutate target artifact metadata.\n\nThis can expose build outputs, logs or packaged artifacts stored as workflow artifacts, and can interfere with in-flight artifact upload staging. Depending on the target upload/finalization flow, it may poison artifact data consumed by later workflow steps, release automation, deployment jobs, or downstream users.\n\nRecommended fix:\n\n- Sign a canonical structured payload, such as JSON/protobuf or length-prefixed fields, instead of concatenating raw values. A versioned payload is preferable, for example `HMAC(version || canonical_payload)`.\n- Include and enforce endpoint, expiry, task ID, artifact ID, artifact name, run ID, run attempt ID, repository ID, and owner ID in the signed payload.\n- After signature verification, load the artifact by signed `artifactID`.\n- Reject the request unless the signed artifact ID, task ID, run ID, run attempt ID, repository ID, owner ID, and artifact name all match.\n- Apply artifact-name validation to V4 artifact creation as hardening.\n\nAdding separators alone is not a complete fix if the post-verification code still trusts URL fields and looks up the artifact only by name/run context. Artifact-name validation is also hardening rather than a root-cause fix, because normal valid artifact names can contain digits and separators. The important security property is binding the signed URL to one canonical artifact, task, run, repository, owner, endpoint, and expiry.","status":"published","published":"2026-07-21T20:36:38Z","modified":"2026-07-27T17:11:37.933389676Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:46:48.920784Z"},{"id":"GO-2026-6060","title":"Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write in code.gitea.io/gitea","description":"Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write in code.gitea.io/gitea","status":"published","published":"2026-07-27T15:32:45Z","modified":"2026-07-27T17:00:23.881251803Z","updated_at":"2026-11-02T15:47:02.838915Z"},{"id":"openSUSE-SU-2026:21551-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z (jsc#PED-11136):\n\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w\n * GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv\n * GO-2026-5048 GHSA-mx64-mj3q-7prj\n * GO-2026-5051\n * GO-2026-5069 CVE-2026-30246 GHSA-35hp-hqmv-8qg8\n * GO-2026-5074 CVE-2026-45022 GHSA-389r-gv7p-r3rp\n * GO-2026-5105 CVE-2026-41506 GHSA-3xc5-wrhm-f963\n * GO-2026-5116 CVE-2026-44517 GHSA-49p4-px3h-rq49\n * GO-2026-5158 CVE-2026-41178 GHSA-5wrp-cwcj-q835\n * GO-2026-5198 CVE-2026-41642 GHSA-7235-89m6-f4px\n * GO-2026-5208 CVE-2026-40890 GHSA-77fj-vx54-gvh7\n * GO-2026-5266 CVE-2026-41643 GHSA-8rxh-r2p6-7f2q\n * GO-2026-5309 GHSA-c3wq-j5vh-68rc\n * GO-2026-5327 CVE-2026-2303 GHSA-cp6g-7hqx-qxhp\n * GO-2026-5336 CVE-2026-45571 GHSA-crhj-59gh-8x96\n * GO-2026-5346 CVE-2026-52845 GHSA-f59h-q822-g45g\n * GO-2026-5408 GHSA-gx7w-56w6-g48x\n * GO-2026-5426 CVE-2026-39883 GHSA-hfvc-g4fc-pqhx\n * GO-2026-5435 CVE-2026-35206 GHSA-hr2v-4r36-88hr\n * GO-2026-5452 CVE-2026-34783 GHSA-j6v5-g24h-vg4j\n * GO-2026-5463 CVE-2026-8276 GHSA-jcqv-2g3v-gm88\n * GO-2026-5471 CVE-2026-6993 GHSA-jj45-xvq5-rhh9\n * GO-2026-5490 CVE-2026-44740 GHSA-m3xc-h892-ggx6\n * GO-2026-5492 CVE-2026-45135 GHSA-m675-2p33-xv9g\n * GO-2026-5506 CVE-2026-29181 GHSA-mh2q-q3fh-2475\n * GO-2026-5525 CVE-2026-42285 GHSA-p3w2-64xm-833j\n * GO-2026-5543 CVE-2026-32952 GHSA-pjcq-xvwq-hhpj\n * GO-2026-5548 CVE-2026-44166 GHSA-pq7p-mc74-g65w\n * GO-2026-5566 CVE-2026-35205 GHSA-q5jf-9vfq-h4h7\n * GO-2026-5569 GHSA-q76j-gcg9-vxc6\n * GO-2026-5585 CVE-2026-42554 GHSA-qjv7-627w-8qjv\n * GO-2026-5593 CVE-2026-40611 GHSA-qqx8-2xmm-jrv8\n * GO-2026-5595 CVE-2026-52844 GHSA-qrp7-cvwr-j2c6\n * GO-2026-5597 CVE-2026-44973 GHSA-qw64-3x98-g7q2\n * GO-2026-5606 GHSA-r46f-3rpw-hxrv\n * GO-2026-5617 CVE-2026-42306 GHSA-rg2x-37c3-w2rh\n * GO-2026-5660 CVE-2026-52846 GHSA-vcc4-2c75-vc9v\n * GO-2026-5666 CVE-2026-35204 GHSA-vmx8-mqv2-9gmg\n * GO-2026-5684 CVE-2026-42328 GHSA-w239-58x2-q8p5\n * GO-2026-5693 GHSA-w5pp-99ch-qj29\n * GO-2026-5730 GHSA-wwhq-w58m-w29c\n * GO-2026-5736 CVE-2026-44283 GHSA-x35m-3gp4-4fh5\n * GO-2026-5740 CVE-2026-44301 GHSA-x597-9fr4-5857\n * GO-2026-5748 CVE-2026-7482 GHSA-x8qc-fggm-mpqg\n * GO-2026-5750 CVE-2026-7020 GHSA-x99g-8v8j-25j2\n * GO-2026-5774 GHSA-3fxj-6jh8-hvhx\n * GO-2026-5775 GHSA-9g5q-2w5x-hmxf\n * GO-2026-5777 GHSA-rjr7-jggh-pgcp\n * GO-2026-5781\n * GO-2026-5841 GHSA-259r-337f-4rfw\n * GO-2026-5879 CVE-2026-50162 GHSA-8xwf-rjm4-xvhv\n * GO-2026-5880 CVE-2026-50163 GHSA-fxhp-mv3v-67qp\n * GO-2026-5882 CVE-2026-50151 GHSA-jxpm-75mh-9fp7\n * GO-2026-5884 GHSA-vh4v-2xq2-g5cg\n * GO-2026-5885 CVE-2026-48978 GHSA-xf85-363p-868w\n * GO-2026-5886 CVE-2026-44332 GHSA-g5vh-55hw-rxm8\n * GO-2026-5887 CVE-2026-45045 GHSA-gcfq-8gqf-4876\n * GO-2026-5912 CVE-2026-53624 GHSA-gv83-gqw6-9j2c\n * GO-2026-5954 CVE-2026-49838 GHSA-frrj-87jh-2772\n * GO-2026-5955 CVE-2026-49837 GHSA-gjrg-jjr3-56cm\n * GO-2026-5960 CVE-2026-54063 GHSA-h69g-9hx6-f3v4\n * GO-2026-5971 CVE-2026-37462 GHSA-pw7p-7fqv-hpj8\n * GO-2026-5983 CVE-2026-54448 GHSA-q3fv-x8vg-qqm4\n * GO-2026-6000 CVE-2026-50274 GHSA-74j5-xf3v-crq8\n * GO-2026-6058 CVE-2026-58442 GHSA-h2x6-g7q6-344v\n * GO-2026-6059 CVE-2026-58431 GHSA-h56g-4qw7-2mxg\n * GO-2026-6060 CVE-2026-58426 GHSA-hg5r-vq93-9fv6\n * GO-2026-6061 GHSA-hrxh-6v49-42gf\n * GO-2026-6062 CVE-2026-58434 GHSA-j2w3-9c3r-g83q\n * GO-2026-6063 CVE-2026-58417 GHSA-jr5x-6h83-wrxf\n * GO-2026-6064 CVE-2026-55984 GHSA-m932-crvm-gcp5\n * GO-2026-6065 CVE-2026-55982 GHSA-mg4f-x9v4-6h2p\n * GO-2026-6066 CVE-2026-58507 GHSA-p4mj-98mv-xq26\n * GO-2026-6067 CVE-2026-58445 GHSA-pgqf-926r-548m\n * GO-2026-6068 CVE-2026-58427 GHSA-prr9-9mp4-5gp2\n * GO-2026-6069 CVE-2026-58510 GHSA-q423-49rw-g9mh\n * GO-2026-6070 CVE-2026-58432 GHSA-q9pg-jj6x-j9p6\n * GO-2026-6071 CVE-2026-59766 GHSA-qf2f-qh6p-7v89\n * GO-2026-6072 CVE-2026-56750 GHSA-rgv6-xp99-6mgj\n * GO-2026-6073 CVE-2026-58435 GHSA-rh79-75qm-gwjr\n * GO-2026-6074 GHSA-rjvx-x5h2-6px5\n * GO-2026-6075 CVE-2026-58418 GHSA-rqhx-647v-wx32\n * GO-2026-6076 CVE-2026-25038 GHSA-v73x-hx65-6pf4\n * GO-2026-6077 CVE-2026-58421 GHSA-v96j-25gv-g2w9\n * GO-2026-6078 CVE-2026-55987 GHSA-vrhc-jjfc-m3m3\n * GO-2026-6079 CVE-2026-58425 GHSA-vxv2-8j6r-pcpg\n * GO-2026-6080 CVE-2026-58439 GHSA-w5pg-649r-p6gg\n * GO-2026-6081 CVE-2026-24451 GHSA-wrf9-r3h7-7x5v\n * GO-2026-6082 CVE-2026-42931 GHSA-wwqq-x6w4-frm2\n * GO-2026-6083 CVE-2026-23603 GHSA-x77v-q46j-393g\n * GO-2026-6084 CVE-2026-58441 GHSA-xmj7-xj85-hfc3\n * GO-2026-6085 CVE-2026-58438 GHSA-xv9x-fj9g-vj6h\n * GO-2026-6086 CVE-2026-58443 GHSA-xxjv-752h-3vp2\n","status":"published","published":"2026-08-10T17:38:07Z","modified":"2026-08-12T18:23:41.809969353Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:23216-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z (jsc#PED-11136):\n\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w\n * GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv\n * GO-2026-5048 GHSA-mx64-mj3q-7prj\n * GO-2026-5051\n * GO-2026-5069 CVE-2026-30246 GHSA-35hp-hqmv-8qg8\n * GO-2026-5074 CVE-2026-45022 GHSA-389r-gv7p-r3rp\n * GO-2026-5105 CVE-2026-41506 GHSA-3xc5-wrhm-f963\n * GO-2026-5116 CVE-2026-44517 GHSA-49p4-px3h-rq49\n * GO-2026-5158 CVE-2026-41178 GHSA-5wrp-cwcj-q835\n * GO-2026-5198 CVE-2026-41642 GHSA-7235-89m6-f4px\n * GO-2026-5208 CVE-2026-40890 GHSA-77fj-vx54-gvh7\n * GO-2026-5266 CVE-2026-41643 GHSA-8rxh-r2p6-7f2q\n * GO-2026-5309 GHSA-c3wq-j5vh-68rc\n * GO-2026-5327 CVE-2026-2303 GHSA-cp6g-7hqx-qxhp\n * GO-2026-5336 CVE-2026-45571 GHSA-crhj-59gh-8x96\n * GO-2026-5346 CVE-2026-52845 GHSA-f59h-q822-g45g\n * GO-2026-5408 GHSA-gx7w-56w6-g48x\n * GO-2026-5426 CVE-2026-39883 GHSA-hfvc-g4fc-pqhx\n * GO-2026-5435 CVE-2026-35206 GHSA-hr2v-4r36-88hr\n * GO-2026-5452 CVE-2026-34783 GHSA-j6v5-g24h-vg4j\n * GO-2026-5463 CVE-2026-8276 GHSA-jcqv-2g3v-gm88\n * GO-2026-5471 CVE-2026-6993 GHSA-jj45-xvq5-rhh9\n * GO-2026-5490 CVE-2026-44740 GHSA-m3xc-h892-ggx6\n * GO-2026-5492 CVE-2026-45135 GHSA-m675-2p33-xv9g\n * GO-2026-5506 CVE-2026-29181 GHSA-mh2q-q3fh-2475\n * GO-2026-5525 CVE-2026-42285 GHSA-p3w2-64xm-833j\n * GO-2026-5543 CVE-2026-32952 GHSA-pjcq-xvwq-hhpj\n * GO-2026-5548 CVE-2026-44166 GHSA-pq7p-mc74-g65w\n * GO-2026-5566 CVE-2026-35205 GHSA-q5jf-9vfq-h4h7\n * GO-2026-5569 GHSA-q76j-gcg9-vxc6\n * GO-2026-5585 CVE-2026-42554 GHSA-qjv7-627w-8qjv\n * GO-2026-5593 CVE-2026-40611 GHSA-qqx8-2xmm-jrv8\n * GO-2026-5595 CVE-2026-52844 GHSA-qrp7-cvwr-j2c6\n * GO-2026-5597 CVE-2026-44973 GHSA-qw64-3x98-g7q2\n * GO-2026-5606 GHSA-r46f-3rpw-hxrv\n * GO-2026-5617 CVE-2026-42306 GHSA-rg2x-37c3-w2rh\n * GO-2026-5660 CVE-2026-52846 GHSA-vcc4-2c75-vc9v\n * GO-2026-5666 CVE-2026-35204 GHSA-vmx8-mqv2-9gmg\n * GO-2026-5684 CVE-2026-42328 GHSA-w239-58x2-q8p5\n * GO-2026-5693 GHSA-w5pp-99ch-qj29\n * GO-2026-5730 GHSA-wwhq-w58m-w29c\n * GO-2026-5736 CVE-2026-44283 GHSA-x35m-3gp4-4fh5\n * GO-2026-5740 CVE-2026-44301 GHSA-x597-9fr4-5857\n * GO-2026-5748 CVE-2026-7482 GHSA-x8qc-fggm-mpqg\n * GO-2026-5750 CVE-2026-7020 GHSA-x99g-8v8j-25j2\n * GO-2026-5774 GHSA-3fxj-6jh8-hvhx\n * GO-2026-5775 GHSA-9g5q-2w5x-hmxf\n * GO-2026-5777 GHSA-rjr7-jggh-pgcp\n * GO-2026-5781\n * GO-2026-5841 GHSA-259r-337f-4rfw\n * GO-2026-5879 CVE-2026-50162 GHSA-8xwf-rjm4-xvhv\n * GO-2026-5880 CVE-2026-50163 GHSA-fxhp-mv3v-67qp\n * GO-2026-5882 CVE-2026-50151 GHSA-jxpm-75mh-9fp7\n * GO-2026-5884 GHSA-vh4v-2xq2-g5cg\n * GO-2026-5885 CVE-2026-48978 GHSA-xf85-363p-868w\n * GO-2026-5886 CVE-2026-44332 GHSA-g5vh-55hw-rxm8\n * GO-2026-5887 CVE-2026-45045 GHSA-gcfq-8gqf-4876\n * GO-2026-5912 CVE-2026-53624 GHSA-gv83-gqw6-9j2c\n * GO-2026-5954 CVE-2026-49838 GHSA-frrj-87jh-2772\n * GO-2026-5955 CVE-2026-49837 GHSA-gjrg-jjr3-56cm\n * GO-2026-5960 CVE-2026-54063 GHSA-h69g-9hx6-f3v4\n * GO-2026-5971 CVE-2026-37462 GHSA-pw7p-7fqv-hpj8\n * GO-2026-5983 CVE-2026-54448 GHSA-q3fv-x8vg-qqm4\n * GO-2026-6000 CVE-2026-50274 GHSA-74j5-xf3v-crq8\n * GO-2026-6058 CVE-2026-58442 GHSA-h2x6-g7q6-344v\n * GO-2026-6059 CVE-2026-58431 GHSA-h56g-4qw7-2mxg\n * GO-2026-6060 CVE-2026-58426 GHSA-hg5r-vq93-9fv6\n * GO-2026-6061 GHSA-hrxh-6v49-42gf\n * GO-2026-6062 CVE-2026-58434 GHSA-j2w3-9c3r-g83q\n * GO-2026-6063 CVE-2026-58417 GHSA-jr5x-6h83-wrxf\n * GO-2026-6064 CVE-2026-55984 GHSA-m932-crvm-gcp5\n * GO-2026-6065 CVE-2026-55982 GHSA-mg4f-x9v4-6h2p\n * GO-2026-6066 CVE-2026-58507 GHSA-p4mj-98mv-xq26\n * GO-2026-6067 CVE-2026-58445 GHSA-pgqf-926r-548m\n * GO-2026-6068 CVE-2026-58427 GHSA-prr9-9mp4-5gp2\n * GO-2026-6069 CVE-2026-58510 GHSA-q423-49rw-g9mh\n * GO-2026-6070 CVE-2026-58432 GHSA-q9pg-jj6x-j9p6\n * GO-2026-6071 CVE-2026-59766 GHSA-qf2f-qh6p-7v89\n * GO-2026-6072 CVE-2026-56750 GHSA-rgv6-xp99-6mgj\n * GO-2026-6073 CVE-2026-58435 GHSA-rh79-75qm-gwjr\n * GO-2026-6074 GHSA-rjvx-x5h2-6px5\n * GO-2026-6075 CVE-2026-58418 GHSA-rqhx-647v-wx32\n * GO-2026-6076 CVE-2026-25038 GHSA-v73x-hx65-6pf4\n * GO-2026-6077 CVE-2026-58421 GHSA-v96j-25gv-g2w9\n * GO-2026-6078 CVE-2026-55987 GHSA-vrhc-jjfc-m3m3\n * GO-2026-6079 CVE-2026-58425 GHSA-vxv2-8j6r-pcpg\n * GO-2026-6080 CVE-2026-58439 GHSA-w5pg-649r-p6gg\n * GO-2026-6081 CVE-2026-24451 GHSA-wrf9-r3h7-7x5v\n * GO-2026-6082 CVE-2026-42931 GHSA-wwqq-x6w4-frm2\n * GO-2026-6083 CVE-2026-23603 GHSA-x77v-q46j-393g\n * GO-2026-6084 CVE-2026-58441 GHSA-xmj7-xj85-hfc3\n * GO-2026-6085 CVE-2026-58438 GHSA-xv9x-fj9g-vj6h\n * GO-2026-6086 CVE-2026-58443 GHSA-xxjv-752h-3vp2\n","status":"published","published":"2026-08-10T17:34:15Z","modified":"2026-08-27T18:23:09.233788558Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23227-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z (jsc#PED-11136):\n\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w\n * GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv\n * GO-2026-5048 GHSA-mx64-mj3q-7prj\n * GO-2026-5051\n * GO-2026-5069 CVE-2026-30246 GHSA-35hp-hqmv-8qg8\n * GO-2026-5074 CVE-2026-45022 GHSA-389r-gv7p-r3rp\n * GO-2026-5105 CVE-2026-41506 GHSA-3xc5-wrhm-f963\n * GO-2026-5116 CVE-2026-44517 GHSA-49p4-px3h-rq49\n * GO-2026-5158 CVE-2026-41178 GHSA-5wrp-cwcj-q835\n * GO-2026-5198 CVE-2026-41642 GHSA-7235-89m6-f4px\n * GO-2026-5208 CVE-2026-40890 GHSA-77fj-vx54-gvh7\n * GO-2026-5266 CVE-2026-41643 GHSA-8rxh-r2p6-7f2q\n * GO-2026-5309 GHSA-c3wq-j5vh-68rc\n * GO-2026-5327 CVE-2026-2303 GHSA-cp6g-7hqx-qxhp\n * GO-2026-5336 CVE-2026-45571 GHSA-crhj-59gh-8x96\n * GO-2026-5346 CVE-2026-52845 GHSA-f59h-q822-g45g\n * GO-2026-5408 GHSA-gx7w-56w6-g48x\n * GO-2026-5426 CVE-2026-39883 GHSA-hfvc-g4fc-pqhx\n * GO-2026-5435 CVE-2026-35206 GHSA-hr2v-4r36-88hr\n * GO-2026-5452 CVE-2026-34783 GHSA-j6v5-g24h-vg4j\n * GO-2026-5463 CVE-2026-8276 GHSA-jcqv-2g3v-gm88\n * GO-2026-5471 CVE-2026-6993 GHSA-jj45-xvq5-rhh9\n * GO-2026-5490 CVE-2026-44740 GHSA-m3xc-h892-ggx6\n * GO-2026-5492 CVE-2026-45135 GHSA-m675-2p33-xv9g\n * GO-2026-5506 CVE-2026-29181 GHSA-mh2q-q3fh-2475\n * GO-2026-5525 CVE-2026-42285 GHSA-p3w2-64xm-833j\n * GO-2026-5543 CVE-2026-32952 GHSA-pjcq-xvwq-hhpj\n * GO-2026-5548 CVE-2026-44166 GHSA-pq7p-mc74-g65w\n * GO-2026-5566 CVE-2026-35205 GHSA-q5jf-9vfq-h4h7\n * GO-2026-5569 GHSA-q76j-gcg9-vxc6\n * GO-2026-5585 CVE-2026-42554 GHSA-qjv7-627w-8qjv\n * GO-2026-5593 CVE-2026-40611 GHSA-qqx8-2xmm-jrv8\n * GO-2026-5595 CVE-2026-52844 GHSA-qrp7-cvwr-j2c6\n * GO-2026-5597 CVE-2026-44973 GHSA-qw64-3x98-g7q2\n * GO-2026-5606 GHSA-r46f-3rpw-hxrv\n * GO-2026-5617 CVE-2026-42306 GHSA-rg2x-37c3-w2rh\n * GO-2026-5660 CVE-2026-52846 GHSA-vcc4-2c75-vc9v\n * GO-2026-5666 CVE-2026-35204 GHSA-vmx8-mqv2-9gmg\n * GO-2026-5684 CVE-2026-42328 GHSA-w239-58x2-q8p5\n * GO-2026-5693 GHSA-w5pp-99ch-qj29\n * GO-2026-5730 GHSA-wwhq-w58m-w29c\n * GO-2026-5736 CVE-2026-44283 GHSA-x35m-3gp4-4fh5\n * GO-2026-5740 CVE-2026-44301 GHSA-x597-9fr4-5857\n * GO-2026-5748 CVE-2026-7482 GHSA-x8qc-fggm-mpqg\n * GO-2026-5750 CVE-2026-7020 GHSA-x99g-8v8j-25j2\n * GO-2026-5774 GHSA-3fxj-6jh8-hvhx\n * GO-2026-5775 GHSA-9g5q-2w5x-hmxf\n * GO-2026-5777 GHSA-rjr7-jggh-pgcp\n * GO-2026-5781\n * GO-2026-5841 GHSA-259r-337f-4rfw\n * GO-2026-5879 CVE-2026-50162 GHSA-8xwf-rjm4-xvhv\n * GO-2026-5880 CVE-2026-50163 GHSA-fxhp-mv3v-67qp\n * GO-2026-5882 CVE-2026-50151 GHSA-jxpm-75mh-9fp7\n * GO-2026-5884 GHSA-vh4v-2xq2-g5cg\n * GO-2026-5885 CVE-2026-48978 GHSA-xf85-363p-868w\n * GO-2026-5886 CVE-2026-44332 GHSA-g5vh-55hw-rxm8\n * GO-2026-5887 CVE-2026-45045 GHSA-gcfq-8gqf-4876\n * GO-2026-5912 CVE-2026-53624 GHSA-gv83-gqw6-9j2c\n * GO-2026-5954 CVE-2026-49838 GHSA-frrj-87jh-2772\n * GO-2026-5955 CVE-2026-49837 GHSA-gjrg-jjr3-56cm\n * GO-2026-5960 CVE-2026-54063 GHSA-h69g-9hx6-f3v4\n * GO-2026-5971 CVE-2026-37462 GHSA-pw7p-7fqv-hpj8\n * GO-2026-5983 CVE-2026-54448 GHSA-q3fv-x8vg-qqm4\n * GO-2026-6000 CVE-2026-50274 GHSA-74j5-xf3v-crq8\n * GO-2026-6058 CVE-2026-58442 GHSA-h2x6-g7q6-344v\n * GO-2026-6059 CVE-2026-58431 GHSA-h56g-4qw7-2mxg\n * GO-2026-6060 CVE-2026-58426 GHSA-hg5r-vq93-9fv6\n * GO-2026-6061 GHSA-hrxh-6v49-42gf\n * GO-2026-6062 CVE-2026-58434 GHSA-j2w3-9c3r-g83q\n * GO-2026-6063 CVE-2026-58417 GHSA-jr5x-6h83-wrxf\n * GO-2026-6064 CVE-2026-55984 GHSA-m932-crvm-gcp5\n * GO-2026-6065 CVE-2026-55982 GHSA-mg4f-x9v4-6h2p\n * GO-2026-6066 CVE-2026-58507 GHSA-p4mj-98mv-xq26\n * GO-2026-6067 CVE-2026-58445 GHSA-pgqf-926r-548m\n * GO-2026-6068 CVE-2026-58427 GHSA-prr9-9mp4-5gp2\n * GO-2026-6069 CVE-2026-58510 GHSA-q423-49rw-g9mh\n * GO-2026-6070 CVE-2026-58432 GHSA-q9pg-jj6x-j9p6\n * GO-2026-6071 CVE-2026-59766 GHSA-qf2f-qh6p-7v89\n * GO-2026-6072 CVE-2026-56750 GHSA-rgv6-xp99-6mgj\n * GO-2026-6073 CVE-2026-58435 GHSA-rh79-75qm-gwjr\n * GO-2026-6074 GHSA-rjvx-x5h2-6px5\n * GO-2026-6075 CVE-2026-58418 GHSA-rqhx-647v-wx32\n * GO-2026-6076 CVE-2026-25038 GHSA-v73x-hx65-6pf4\n * GO-2026-6077 CVE-2026-58421 GHSA-v96j-25gv-g2w9\n * GO-2026-6078 CVE-2026-55987 GHSA-vrhc-jjfc-m3m3\n * GO-2026-6079 CVE-2026-58425 GHSA-vxv2-8j6r-pcpg\n * GO-2026-6080 CVE-2026-58439 GHSA-w5pg-649r-p6gg\n * GO-2026-6081 CVE-2026-24451 GHSA-wrf9-r3h7-7x5v\n * GO-2026-6082 CVE-2026-42931 GHSA-wwqq-x6w4-frm2\n * GO-2026-6083 CVE-2026-23603 GHSA-x77v-q46j-393g\n * GO-2026-6084 CVE-2026-58441 GHSA-xmj7-xj85-hfc3\n * GO-2026-6085 CVE-2026-58438 GHSA-xv9x-fj9g-vj6h\n * GO-2026-6086 CVE-2026-58443 GHSA-xxjv-752h-3vp2\n","status":"published","published":"2026-08-10T17:34:15Z","modified":"2026-08-27T18:23:10.174179412Z","updated_at":"2026-11-02T15:54:03.503431Z"}]}}