CVE-2026-24058

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

Soft Serve, a self-hostable Git server designed for command-line use, contains a critical authentication bypass vulnerability in versions 0.11.2 and prior, tracked as CVE-2026-24058. The flaw arises during the SSH handshake, where an attacker can offer a victim's public key before authenticating with their own valid key. This causes the victim's user identity to be stored in the session context during the "offer" phase and not cleared upon failure of that specific authentication attempt, enabling impersonation of any user, including administrators. The vulnerability is rated 9.8 on the CVSS 3.1 scale (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-289 (Authentication Bypass by Alternate Name).

Any unauthenticated attacker with network access to the Soft Serve instance can exploit this vulnerability remotely with low complexity and no privileges required. By initiating an SSH connection, offering a target user's public key (which could be obtained from public sources), and then proceeding with their own successful authentication, the attacker inherits the offered user's identity for the session. This grants full impersonation capabilities, allowing read/write access to repositories, administrative actions, and potential compromise of the entire Git server depending on the victim's privileges.

The issue has been addressed in Soft Serve version 0.11.3, as detailed in the project's security advisory (GHSA-pchf-49fh-w34r), release notes, and the fixing commit (8539f9ad39918b67d612a35785a2b4326efc8741). Security practitioners should immediately upgrade to v0.11.3 or later and audit SSH access logs for suspicious handshake patterns involving mismatched keys.