8.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-24058

CVE-2026-24058: Soft Serve has Critical Authentication Bypass

Soft Serve is a self-hostable Git server for the command line. Versions 0.11.2 and below have a critical authentication bypass vulnerability that allows an attacker to impersonate any user (including admin) by "offering" the victim's public key during the SSH handshake before authenticating with their own valid key. This occurs because the user identity is stored in the session context during the "offer" phase and is not cleared if that specific authentication attempt fails. This issue has been fixed in version 0.11.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-24058

CVE-2026-24058:

8.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/charmbracelet/soft-serve	go	<= 0.11.2	0.11.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a critical authentication bypass in the SSH server logic. It stems from a flaw in how the user's identity was managed during the public key authentication handshake. The process involves two key functions: PublicKeyHandler and AuthenticationMiddleware.

SSHServer.PublicKeyHandler: This function is called for each public key an SSH client offers. The vulnerability was introduced here because the code would immediately look up the user associated with the offered public key and store that user's identity in the session context. This happened before the client had to prove ownership of the key. An attacker could abuse this by offering the public key of a privileged user (the victim), thereby "poisoning" the session context with the victim's identity.
AuthenticationMiddleware: This function runs after a key has been successfully verified. The flaw here was that it did not re-verify and set the user identity based on the key that actually passed authentication. Instead, it trusted the (potentially poisoned) user identity already in the context. So, after the attacker's initial attempt with the victim's key failed (as expected), they would proceed to authenticate with their own valid key. The AuthenticationMiddleware would see a successful authentication but would fail to update the user context, leaving the attacker authenticated as the victim.

The patch rectifies this by removing the premature user-setting logic from PublicKeyHandler and adding explicit user-setting logic to AuthenticationMiddleware. This ensures the user identity in the context always matches the public key that was successfully used to authenticate, thereby closing the bypass vulnerability.

Vulnerable functions

SSHServer.PublicKeyHandler

pkg/ssh/ssh.go

This function is part of the SSH server's public key authentication process. In the vulnerable version, it would look up a user by their public key and store that user object in the session context as soon as the key was offered by the client, but *before* the client had proven ownership of the corresponding private key. This allowed an attacker to place a victim's user object (e.g., an admin's) into the context, which would not be cleared upon the inevitable signature verification failure.

AuthenticationMiddleware

pkg/ssh/middleware.go

This middleware was intended to validate the final authentication state. However, it failed to explicitly set the user in the context based on the public key that was actually used for successful authentication. It implicitly trusted the user object already present in the context. An attacker could exploit this by first triggering `PublicKeyHandler` with a victim's key to poison the context, and then completing authentication with their own key. This middleware would then proceed with the victim's identity still in the context. The patch corrects this by re-looking up the user with the authenticated key and setting it in the context.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.