PT-2026-4297 · Unknown · Soft Serve

Juancabe · Published 2026-01-21 · Updated 2026-02-06 · CVE-2026-24058

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Soft Serve versions 0.11.2 and below

Description Soft Serve, a self-hostable Git server, contains a critical flaw that allows an attacker to impersonate any user, including administrators. This is achieved by presenting the victim's public key during the SSH handshake before authenticating with a valid key. The user identity is retained in the session context even if the authentication attempt fails, enabling the impersonation.

Recommendations Update to version 0.11.3 or later.

Exploit

Fix

Weakness Enumeration

CWE-289

Related Identifiers

CVE-2026-24058

GHSA-PCHF-49FH-W34R

GO-2026-4353

SUSE-SU-2026:0403-1

Affected Products

Soft Serve

References · 89

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24058.json · Exploit
• https://github.com/charmbracelet/soft-serve/commit/8539f9ad39918b67d612a35785a2b4326efc8741 · Patch
• https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-pchf-49fh-w34r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24058 · Security Note
• https://osv.dev/vulnerability/GHSA-pchf-49fh-w34r · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4353 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0403-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-24058 · Vendor Advisory
• https://github.com/charmbracelet/soft-serve · Note
• https://github.com/charmbracelet/soft-serve/releases/tag/v0.11.3 · Note
• https://suse.com/security/cve/CVE-2026-23845 · Note
• https://suse.com/security/cve/CVE-2026-25160 · Note
• https://suse.com/security/cve/CVE-2026-25145 · Note
• https://suse.com/security/cve/CVE-2026-24735 · Note
• https://suse.com/security/cve/CVE-2026-24058 · Note