Post-breach (CVE-2026-59774) rotation. All three security secrets shared
one generated value via the gitea-random SecretClaim, and the file-read
exploit leaked it. Split INTERNAL_TOKEN and JWT_SECRET into their own
claims (gitea-internal-token, gitea-oauth2-jwt) with fresh distinct
values and repoint the StatefulSet at them.
INTERNAL_TOKEN is the secret the attacker actually used against the
still-internet-reachable /api/internal, so this closes reuse of any saved
copy. Rotating JWT_SECRET invalidates gitea-issued OAuth2 and LFS tokens,
so the OAuth2 integrations (Woodpecker, tea, credential helpers) need one
re-login.
SECRET_KEY is deliberately left on gitea-random: rotating it would break
the 2 push mirrors (encrypted creds) and must be done in a window that
re-enters those credentials.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The rootless image defaulted SSH_LISTEN_PORT to SSH_PORT until 1.26; in
1.27 docker-setup.sh leaves it empty, so Gitea fell back to SSH_PORT=22
and crash-looped with "listen tcp :22: bind: permission denied" as uid
1000. The Service already maps 22 -> 2222, so pin the listen port
explicitly rather than depending on an image default.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Fixes CVE-2026-59774, an unauthenticated arbitrary file read in the
Org-mode renderer (POST /{owner}/{repo}/markup, #+INCLUDE directive)
affecting 1.22.1-1.27.0. It was used against this instance on 2026-09-10
to read app.ini, steal INTERNAL_TOKEN and plant an uploadpack
packObjectsHook that ran a Monero miner on every clone. The 1.25 branch
never received the fix, so this skips 1.26.
Env-var config still works: the rootless image's environment-to-ini is
now a shim for `gitea config edit-ini --in-place --apply-env`.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Erki AasandClaude Opus 4.8
eaas
Erki Aas
rasmus