PT-2026-4297 · Unknown · Soft Serve

Juancabe · Publicado 2026-01-21 · Atualizado 2026-02-06 · CVE-2026-24058

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Soft Serve versions 0.11.2 and below

Description Soft Serve, a self-hostable Git server, contains a critical flaw that allows an attacker to impersonate any user, including administrators. This is achieved by presenting the victim's public key during the SSH handshake before authenticating with a valid key. The user identity is retained in the session context even if the authentication attempt fails, enabling the impersonation.

Recommendations Update to version 0.11.3 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-289

Identificadores relacionados

CVE-2026-24058

GHSA-PCHF-49FH-W34R

GO-2026-4353

SUSE-SU-2026:0403-1

Produtos afetados

Soft Serve

Referências · 89

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24058.json · Exploit
• https://github.com/charmbracelet/soft-serve · Nota
• https://github.com/charmbracelet/soft-serve/commit/8539f9ad39918b67d612a35785a2b4326efc8741 · Correção
• https://github.com/charmbracelet/soft-serve/releases/tag/v0.11.3 · Nota
• https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-pchf-49fh-w34r · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2026-23845 · Nota
• https://suse.com/security/cve/CVE-2026-25160 · Nota
• https://suse.com/security/cve/CVE-2026-25145 · Nota
• https://suse.com/security/cve/CVE-2026-24735 · Nota
• https://suse.com/security/cve/CVE-2026-24058 · Nota
• https://suse.com/security/cve/CVE-2026-20800 · Nota
• https://suse.com/security/cve/CVE-2026-25121 · Nota
• https://suse.com/security/cve/CVE-2026-20904 · Nota
• https://suse.com/security/cve/CVE-2026-23992 · Nota
• https://suse.com/security/cve/CVE-2026-25122 · Nota