9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-30832

CVE-2026-30832: Soft Serve: SSRF via unvalidated LFS endpoint in repo import

Soft Serve is a self-hostable Git server for the command line. From version 0.6.0 to before version 0.11.4, an authenticated SSH user can force the server to make HTTP requests to internal/private IP addresses by running repo import with a crafted --lfs-endpoint URL. The initial batch request is blind (the response from a metadata endpoint won't parse as valid LFS JSON), but an attacker hosting a fake LFS server can chain this into full read access to internal services by returning download URLs that point at internal targets. This issue has been patched in version 0.11.4.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-30832

CVE-2026-30832:

9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/charmbracelet/soft-serve	go	>= 0.6.0, < 0.11.4	0.11.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) in the LFS import functionality of soft-serve. The root cause is the use of the default Go HTTP client (http.DefaultClient) without any validation of the user-provided LFS endpoint URL. An authenticated user can import a repository and specify a malicious URL for the --lfs-endpoint flag. The application uses this URL to create an LFS client and subsequently makes HTTP requests to it.

The function newHTTPClient in pkg/lfs/http_client.go is responsible for creating the insecure client. The (*BasicTransferAdapter).performRequest function in pkg/lfs/basic_transfer.go then uses this client to make requests. By hosting a fake LFS server, an attacker can trick the server into making requests to internal services and read the responses.

The vulnerability is triggered initially through the ImportRepository function in pkg/backend/repo.go. If the repository is imported as a mirror, the vulnerability becomes persistent, as the (*Mirror).Run function in pkg/jobs/mirror.go will periodically sync the repository and re-trigger the SSRF.

Vulnerable functions

newHTTPClient

pkg/lfs/http_client.go

This function creates a new HTTP client for LFS operations using `http.DefaultClient`, which lacks any SSRF protection. This allows attackers to specify malicious LFS endpoints that the server will then make requests to.

(*BasicTransferAdapter).performRequest

pkg/lfs/basic_transfer.go

This method performs the HTTP request using the insecure client created by `newHTTPClient`. The request URL (`l.Href`) is taken from the LFS server's response, which can be controlled by an attacker running a fake LFS server. This allows for a full-read SSRF vulnerability, as the response from the internal service is returned to the attacker.

ImportRepository

pkg/backend/repo.go

This function is the entry point for the vulnerability. It takes the user-supplied `--lfs-endpoint` during a repository import and uses it to configure the LFS client without any validation, leading to the SSRF.

(*Mirror).Run

pkg/jobs/mirror.go

This function is part of a recurring job that syncs mirrored repositories. It reads the LFS endpoint from the repository's configuration, which was set during the initial import. This allows the SSRF vulnerability to persist and be triggered periodically without further user interaction.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.