Gitea: Secret exposure through reusable workflows in pull_request_target
Summary
Gitea Actions loads local reusable workflows (uses: ./...) for pull_request_target runs from the fork's head commit instead of the trusted base branch. A fork author who can open pull requests can change the called workflow so that attacker-controlled code runs with the repository and organization secrets available to that event. The attack requires a base workflow that calls a local reusable workflow.
Affected
- Gitea 1.19.0 up to but not including 1.27.2 (per the CNA record)
Fixed in
- Gitea 1.27.2 (fixed by PR #38886 and #38897)
- Gitea 1.27.3 also contains the fix
Workaround
- No vendor workaround documented.
- Until patched, avoid pull_request_target workflows that call local reusable workflows and have access to secrets.
- Require maintainer approval before workflows from fork pull requests run.
Exploitation
- No known in-the-wild exploitation or public proof of concept.
- CISA SSVC: exploitation none, not automatable, total technical impact.
- The patch diff has been public since August 2026, so n-day exploitation is possible.
Our recommendation
- Upgrade to Gitea 1.27.2 or later.
- Check whether any pull_request_target workflow calls a local reusable workflow and uses secrets.
- Restrict who can open fork pull requests and review workflow runs from forks.
- Monitor workflow runs triggered by pull_request_target for unexpected changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Gitea 1.27.2 is released blog.gitea.com
- Pull Request #38886: resolve pull_request_target reusable workflows at the base commit github.com
- Pull Request #38897: backport to 1.27 github.com
- Gitea 1.27.2 release github.com
- GHSA-r9ch-mqjm-g67v security advisory github.com
- OSV: CVE-2026-73800 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 16:48.
Original description (NVD)
Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pull_request_target event. A fork author can modify a referenced reusable workflow so attacker-controlled code executes with the repository and organization secrets available to that event. Exploitation requires a base workflow that calls a local reusable workflow, and bypasses the intended separation between trusted base code and untrusted fork code.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.