Vulnerability details

CVE-2026-30832

charmbracelet soft-serve

Soft Serve: SSRF via unvalidated LFS endpoint in repo import

CVSS 3.1

9.1Critical

Official description

Soft Serve is a self-hostable Git server for the command line. From version 0.6.0 to before version 0.11.4, an authenticated SSH user can force the server to make HTTP requests to internal/private IP addresses by running repo import with a crafted --lfs-endpoint URL. The initial batch request is blind (the response from a metadata endpoint won't parse as valid LFS JSON), but an attacker hosting a fake LFS server can chain this into full read access to internal services by returning download URLs that point at internal targets. This issue has been patched in version 0.11.4.

CVSS scores

Score	Version	Source	Vector
9.1Critical	3.1	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L`

Affected products

Vendor	Product	Versions	Source
charmbracelet	soft-serve	>= 0.6.0, < 0.11.4	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/charmbracelet/soft-serve/security/advisories/GHSA-3fvx-xrxq-8jvv x_refsource_CONFIRM
https://github.com/charmbracelet/soft-serve/commit/3ef660098ab37a7950457da8ecc25b516e37ce4e x_refsource_MISC
https://github.com/charmbracelet/soft-serve/releases/tag/v0.11.4 x_refsource_MISC

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-03-07
Last updated: 2026-03-09
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.36%

Probability of exploitation in 30 days

30.5%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: Proof of concept
Technical impact: Partial

Weaknesses (CWE)

CWE-918
Server-Side Request Forgery (SSRF)