CNNVD-202601-3453 Information

Jan 22, 2026 cve

CNNVD ID

CNNVD-202601-3453

CVE-2026-24058

CNNVD Published: 2026-01-22

Description (Chinese)

Soft Serve是Charm开源的一个可自托管的命令行 Git 服务器。 Soft Serve 0.11.2及之前版本存在安全漏洞，该漏洞源于身份验证绕过，攻击者可在SSH握手阶段提供受害者公钥进行冒充，可能导致任意用户（包括管理员）身份被冒用。

Description (English)

Soft Serve is a self-serving command line of Charming open source Git server. Soft Serve 0.11.2 and previous versions had a security loophole, which stemmed from a circumvention of identification, where the aggressor could impersonate the victim ’ s public key during the SSH handshake, which could lead to the fraudulent use of any user ’ s (including administrator ’ s) identity.

Hazard Level

Low

Vulnerability Type

其他

Affected Vendor

Charm

Published

2026-01-22

Last Modified

2026-02-24

References

https://github.com/charmbracelet/soft-serve/commit/8539f9ad39918b67d612a35785a2b4326efc8741 https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-pchf-49fh-w34r https://github.com/charmbracelet/soft-serve/releases/tag/v0.11.3 https://access.redhat.com/security/cve/cve-2026-24058

Patch

https://github.com/charmbracelet/soft-serve/releases

Share on: