---
id: CVE-2026-103059
title: >-
  When Gitea's built-in SSH server is enabled (`START_SSH_SERVER = true`), the
  presented public key was looked up with an SQL `LIKE` comparison of its
  encoded content, which is case-insensitive on some databases, including the
  default SQLi…
summary: >-
  When Gitea's built-in SSH server is enabled (`START_SSH_SERVER = true`), the
  presented public key was looked up with an SQL `LIKE` comparison of its
  encoded content, which is case-insensitive on some databases, including the
  default SQLi…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-305
vendor: gitea
product: gitea
affected:
  - gitea < 28.0.0
patched:
  - gitea 28.0.0
published: '2026-10-06'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T02:26:26.567'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-103059'
references:
  - url: 'https://blog.gitea.com/release-of-28.0.0/'
    label: 88ee5874-cf24-4952-aea0-31affedb7ff2
  - url: 'https://github.com/go-gitea/gitea/pull/39423'
    label: 88ee5874-cf24-4952-aea0-31affedb7ff2
  - url: 'https://github.com/go-gitea/gitea/releases/tag/v28.0.0'
    label: 88ee5874-cf24-4952-aea0-31affedb7ff2
  - url: 'https://github.com/go-gitea/gitea/security/advisories/GHSA-8pwg-hcgm-54cp'
    label: 88ee5874-cf24-4952-aea0-31affedb7ff2
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103059.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-103059'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-103059'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-103059'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00391
epssPercentile: 0.33048
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-07T14:17:16.900412Z'
scores:
  nvd: 9.1
  adp: 9.1
  vendor: 7.4
ingestedAt: '2026-10-06T20:16:42.499Z'
---

## Overview

When Gitea's built-in SSH server is enabled (`START_SSH_SERVER = true`), the presented public key was looked up with an SQL `LIKE` comparison of its encoded content, which is case-insensitive on some databases, including the default SQLite. An attacker who can construct a case variant of another user's registered RSA public key for which they can derive the private key could have that key matched to the victim's account and authenticate over SSH as that user. Keys are now looked up by fingerprint.

## Affected

- `gitea < 28.0.0`

## Remediation

Upgrade past the affected range:

- `gitea 28.0.0`

## Vendor advisories

- **Red Hat VEX** · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103059.json)