CVE-2026-24058
Soft Serve has Critical Authentication Bypass
Reported by github_m · Published January 22, 2026
github.com/charmbracelet/soft-serve is fixed in 0.11.3 (Go Modules)
Soft Serve is a self-hostable Git server for the command line. Versions 0.11.2 and below have a critical authentication bypass vulnerability that allows an attacker to impersonate any user (including admin) by "offering" the victim's public key during the SSH handshake before authenticating with their own valid key. This occurs because the user identity is stored in the session context during the "offer" phase and is not cleared if that specific authentication attempt fails. This issue has been fixed in version 0.11.3.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| github.com/charmbracelet/soft-serve | Go Modules | 0.11.3 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| charmbracelet | soft-serve | < 0.11.3 |
| github.com | charmbracelet/soft-serve | 0 |
| charmbracelet | soft-serve | 0 |
Timeline
- Jan 21, 2026 CVE Published
- Jan 22, 2026 PoC Published
- Jan 23, 2026 EPSS Score (30 in total, the first dated here)
- Jan 23, 2026 CVE Updated
- Jan 30, 2026 Security Advisory
- Mar 22, 2026 Coalition ESS Score (2 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-24058
vulnetix vdb fixes CVE-2026-24058Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-24058/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-pchf-49fh-w34r x_refsource_CONFIRM
- https://github.com/charmbracelet/soft-serve/commit/8539f9ad39918b67d612a35785a2b4326efc8741 x_refsource_MISC
- https://github.com/charmbracelet/soft-serve/releases/tag/v0.11.3 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-24058 advisory
- https://github.com/advisories/GHSA-pchf-49fh-w34r advisory
- https://github.com/charmbracelet/soft-serve url