GO-2026-4353
NoneCVSS
—
EPSS
—
Published
Feb 2, 2026
CISA due date
—
The record
Soft Serve Affected by an Authentication Bypass in github.com/charmbracelet/soft-serve
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/charmbracelet/soft-serve | 0 | 0.11.3 |
Related vulnerabilities
- CVE-2026-24058 Soft Serve is a self-hostable Git server for the command line. Same vulnerability
- GO-2026-4290 Soft Serve is missing an authorization check in LFS lock deletion in… Also affects github.com/charmbracelet/soft-serve
- CVE-2026-22253 Soft Serve is a self-hostable Git server for the command line. Also affects github.com/charmbracelet/soft-serve
- GO-2025-4111 Soft Serve is vulnerable to SSRF through its Webhooks in… Also affects github.com/charmbracelet/soft-serve
- GO-2025-4106 Soft Serve does not sanitize ANSI escape sequences in user input in… Also affects github.com/charmbracelet/soft-serve
- CVE-2025-64522 Soft Serve is vulnerable to SSRF through its Webhooks Also affects github.com/charmbracelet/soft-serve
- CVE-2025-64494 Soft Serve is a self-hostable Git server for the command line. Also affects github.com/charmbracelet/soft-serve