CVE-2026-30832

CRITICAL SEVERITY

CVSS Score & Metrics

Base Score

9.1 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L                                    

Vulnerability Description

Soft Serve is a self-hostable Git server for the command line. From version 0.6.0 to before version 0.11.4, an authenticated SSH user can force the server to make HTTP requests to internal/private IP addresses by running repo import with a crafted --lfs-endpoint URL. The initial batch request is blind (the response from a metadata endpoint won't parse as valid LFS JSON), but an attacker hosting a fake LFS server can chain this into full read access to internal services by returning download URLs that point at internal targets. This issue has been patched in version 0.11.4.

Vulnerability Details

Published Date

March 06, 2026

Last Modified

March 11, 2026

CWE ID

CWE-918

Source

GitHub

Vendor

Product

github.com/charmbracelet/soft-serve

External References

https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-3fvx-xrxq-8jvv
https://github.com/charmbracelet/soft-serve/commit/3ef660098ab37a7950457da8ecc25b516e37ce4e
https://github.com/charmbracelet/soft-serve/releases/tag/v0.11.4
https://github.com/advisories/GHSA-3fvx-xrxq-8jvv

CVE-2026-30832

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment