portbuster1337/CVE-2026-27771

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script that exploits CVE-2026-27771, an authorization bypass in Gitea's container registry, to pull private container images without authentication. It includes scan, pull, and auto-registration commands.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Python exploit script and a README for CVE-2026-27771, a Gitea container registry authorization bypass. The code performs OCI registry enumeration, manifest and blob download, and optional account registration—all actions consistent with demonstrating the described vulnerability. No concealed executable behavior, unrelated payload delivery, credential exfiltration to an external party, persistence mechanism, or operator-directed harm was observed. The script's network requests target only the user-supplied Gitea instance, and all downloaded content is written to local disk under predictable output directories.

ClassificationExploit
Model confidence98%
AuthenticationNot required
Languagespython
Target softwareGitea
Attack typesauthorization bypassinformation disclosure
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is a Python script that actively exploits the vulnerability by obtaining an anonymous token, enumerating private repositories, and downloading their container image layers. The README explicitly labels it as an 'Exploit PoC' and describes its purpose as pulling private container images without authentication.

CVE-2026-27771-exploit.py:3-8README.md:55README.md:92-97

Requirements

  • Target Gitea instance < 1.26.2 with OCI container registry enabledREADME.md:60
  • Python 3.8+README.md:59

Observed behavior

  • Performs a pre-flight check to determine Gitea version, registry presence, and vulnerability statusCVE-2026-27771-exploit.py:313-409
  • Obtains an anonymous ghost token (UserID: -1) from /v2/token when REQUIRE_SIGNIN_VIEW is falseCVE-2026-27771-exploit.py:384-396
  • Enumerates all container repositories via /v2/_catalog, including private onesCVE-2026-27771-exploit.py:414-418
  • Lists tags for each repository via /v2/<repo>/tags/listCVE-2026-27771-exploit.py:421-425
  • Fetches OCI manifests and downloads all blob layers for each tagCVE-2026-27771-exploit.py:428-451
  • Extracts downloaded gzip-compressed tar layers to a local directoryCVE-2026-27771-exploit.py:517-528
  • Supports auto-registration of new accounts on instances without captchaCVE-2026-27771-exploit.py:151-285
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Behavior
All HTTP requests target the user-supplied base URL or its sub-paths (/v2/, /v2/token, /v2/_catalog, /v2/<repo>/manifests/<ref>, /v2/<repo>/blobs/<digest>, /user/sign_up, /user/login, /api/v1/users/<username>/tokens, /api/v1/version).Demonstrates that the script only interacts with the target Gitea instance and does not contact any unrelated external service.CVE-2026-27771-exploit.py:68-76CVE-2026-27771-exploit.py:129-131CVE-2026-27771-exploit.py:414-451
File System Behavior
Downloaded blobs are saved to a local directory (pulled_<repo>/blobs/) and extracted to pulled_<repo>/extracted/. Manifest JSON files are also written locally.All output is written to predictable local paths derived from the repository name; no system file modification or hidden directory creation is performed.CVE-2026-27771-exploit.py:441-451CVE-2026-27771-exploit.py:489-528
Credential Handling
The script accepts a personal access token (PAT) or JWT via --token, exchanges a PAT for a JWT using Basic auth, and uses the resulting token in Bearer Authorization headers. No credentials are transmitted to any third party.Credential usage is limited to authenticating against the target Gitea instance; there is no exfiltration or storage outside the local process.CVE-2026-27771-exploit.py:125-139CVE-2026-27771-exploit.py:360-383
Registration Behavior
The 'register' command automates account creation and token generation on the target Gitea instance when no captcha is present.This is a legitimate step for obtaining authenticated access to demonstrate the vulnerability; it does not install persistence or escalate privileges beyond the created account.CVE-2026-27771-exploit.py:151-285
Review boundaries

What the analysis did not establish

  • Evidence consists of two complete text files; no binary or omitted files. The artifact's behavior is inferred from source code analysis only; the code was not executed.
  • Only the two text files (CVE-2026-27771-exploit.py and README.md) were reviewed; no binary files or other repository content were inspected.
  • The review is static; no dynamic analysis or execution was performed to confirm runtime behavior.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1