Soft Serve 0.7.1 through 0.11.6 Information Disclosure via LFS Locks
Soft Serve versions 0.7.1 through 0.11.6 fail to scope Git LFS lock queries by repository, allowing authenticated users to read lock metadata from repositories they cannot access. Attackers with write access to any repository can enumerate lock IDs globally to recover locked file paths, usernames, and lock timestamps from private repositories.
CVE-2026-91773
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-91773
soft-serve
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "charmbracelet",
"product": "soft-serve",
"versions": [
{
"status": "affected",
"version": "0.7.1",
"lessThan": "0.12.0",
"versionType": "semver"
}
],
"packageURL": "pkg:golang/github.com/charmbracelet/soft-serve",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-91773
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #1666 · Revision 1
- Added to Heist Feed
- Publisher date