CVE-2026-30832 - Vulnerability Analysis

Overview

Soft Serve 0.6.0 to < 0.11.4 contains a server-side request forgery caused by crafted --lfs-endpoint URL in repo import, letting authenticated SSH users make HTTP requests to internal IPs, exploit requires authentication.

Severity & Score

Impact

Authenticated attackers can make HTTP requests to internal services, potentially leading to unauthorized internal data access.

Mitigation

Upgrade to version 0.11.4 or later.

References

• https://github.com/charmbracelet/soft-serve/commit/3ef660098ab37a7950457da8ecc25b516e37ce4e
• https://github.com/charmbracelet/soft-serve/releases/tag/v0.11.4
• https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-3fvx-xrxq-8jvv

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 8, 2026

🔴 CVE-2026-30832 - Critical (9.1) Soft Serve is a self-hostable Git server for the command line. From version 0.6.0 to before version 0.11.4, an authenticated SSH user can force the server to make HTTP requests to internal/private IP addresses by running repo import with a crafted... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30832/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner