CVE-2026-30832

Soft Serve is a self-hostable Git server for the command line. From version 0.6.0 to before version 0.11.4, an authenticated SSH user can force the server to make HTTP requests to internal/private IP addresses by running repo import with a crafted --lfs-endpoint URL. The initial batch request is blind (the response from a metadata endpoint won't parse as valid LFS JSON), but an attacker hosting a fake LFS server can chain this into full read access to internal services by returning download URLs that point at internal targets. This issue has been patched in version 0.11.4.

• CWE-918

• https://github.com/charmbracelet/soft-serve/commit/3ef660098ab37a7950457da8ecc25b516e37ce4ePatch
• https://github.com/charmbracelet/soft-serve/releases/tag/v0.11.4Product, Release Notes
• https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-3fvx-xrxq-8jvvExploit, Mitigation, Vendor Advisory

Published

Mar 7, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-30827express-rate-limit is a basic rate-limiting middleware for E…7.5
• CVE-2026-30828Wallos is an open-source, self-hostable personal subscriptio…7.5
• CVE-2026-30829Checkmate is an open-source, self-hosted tool designed to tr…5.3
• CVE-2026-3083GStreamer rtpqdm2depay Out-Of-Bounds Write Remote Code Execu…8.8
• CVE-2026-30830Defuddle cleans up HTML pages. Prior to version 0.9.0, the _…6.1
• CVE-2026-30831Rocket.Chat is an open-source, secure, fully customizable co…9.8
• CVE-2026-30833Rocket.Chat is an open-source, secure, fully customizable co…5.3
• CVE-2026-30834PinchTab is a standalone HTTP server that gives AI agents di…7.5
• CVE-2026-30835Parse Server is an open source backend that can be deployed …5.3
• CVE-2026-30836Step CA is an online certificate authority for secure, autom…10
• CVE-2026-30837Elysia is a Typescript framework for request validation, typ…7.5
• CVE-2026-30838league/commonmark is a PHP Markdown parser. Prior to version…6.1