CVE-2026-30832

CRITICAL

9.1

Descricao

Soft Serve is a self-hostable Git server for the command line. From version 0.6.0 to before version 0.11.4, an authenticated SSH user can force the server to make HTTP requests to internal/private IP addresses by running repo import with a crafted --lfs-endpoint URL. The initial batch request is blind (the response from a metadata endpoint won't parse as valid LFS JSON), but an attacker hosting a fake LFS server can chain this into full read access to internal services by returning download URLs that point at internal targets. This issue has been patched in version 0.11.4.

Detalhes CVE

Pontuacao CVSS v3.19.1

SeveridadeCRITICAL

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosLOW

Interacao do usuarioNONE

Publicado3/7/2026

Ultima modificacao3/11/2026

Fontenvd

Avistamentos honeypot0

Produtos afetados

charm:soft_serve

Fraquezas (CWE)

CWE-918

Referencias

https://github.com/charmbracelet/soft-serve/commit/3ef660098ab37a7950457da8ecc25b516e37ce4e(security-advisories@github.com)

https://github.com/charmbracelet/soft-serve/releases/tag/v0.11.4(security-advisories@github.com)

https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-3fvx-xrxq-8jvv(security-advisories@github.com)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.