CVE-2026-24058
Critical · 9.8CVSS
9.8
EPSS
0.6%
Published
Jan 22, 2026
CISA due date
—
The record
Soft Serve is a self-hostable Git server for the command line. Versions 0.11.2 and below have a critical authentication bypass vulnerability that allows an attacker to impersonate any user (including admin) by "offering" the victim's public key during the SSH handshake before authenticating with their own valid key. This occurs because the user identity is stored in the session context during the "offer" phase and is not cleared if that specific authentication attempt fails. This issue has been fixed in version 0.11.3.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/charmbracelet/soft-serve | 0 | 0.11.3 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260205T172317-150000.1.146.1 |
Related vulnerabilities
- GO-2026-4353 Soft Serve Affected by an Authentication Bypass in github.com/charmbracelet/soft-serve Same vulnerability
- GO-2026-4290 Soft Serve is missing an authorization check in LFS lock deletion in… Also affects github.com/charmbracelet/soft-serve
- CVE-2026-22253 Soft Serve is a self-hostable Git server for the command line. Also affects github.com/charmbracelet/soft-serve
- GO-2025-4111 Soft Serve is vulnerable to SSRF through its Webhooks in… Also affects github.com/charmbracelet/soft-serve
- GO-2025-4106 Soft Serve does not sanitize ANSI escape sequences in user input in… Also affects github.com/charmbracelet/soft-serve
- CVE-2025-64522 Soft Serve is vulnerable to SSRF through its Webhooks Also affects github.com/charmbracelet/soft-serve
- CVE-2025-64494 Soft Serve is a self-hostable Git server for the command line. Also affects github.com/charmbracelet/soft-serve
- CVE-2026-33990 Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using… Also affects govulncheck-vulndb