How severe is CVE-2026-24058?

CVE-2026-24058 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2026-24058 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (41st percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-24058?

CVE-2026-24058 affects Charm Soft Serve. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-24058?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2026-24058 have an EU (EUVD) identifier?

Yes. CVE-2026-24058 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-4129.

When was CVE-2026-24058 published?

CVE-2026-24058 was published on 2026-01-22 and last updated on 2026-06-17.

CVE-2026-24058

CVE-2026-24058 is a critical-severity vulnerability in Charm Soft Serve with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-289.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
CVSS v4: 8.1
EPSS exploit prediction: 1% (41st percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-4129
Weakness: CWE-289
Affected product: Charm Soft Serve
Published: 2026-01-22
Last modified: 2026-06-17

Description

Soft Serve is a self-hostable Git server for the command line. Versions 0.11.2 and below have a critical authentication bypass vulnerability that allows an attacker to impersonate any user (including admin) by "offering" the victim's public key during the SSH handshake before authenticating with their own valid key. This occurs because the user identity is stored in the session context during the "offer" phase and is not cleared if that specific authentication attempt fails. This issue has been fixed in version 0.11.3.

Frequently asked questions

What is CVE-2026-24058?: Soft Serve is a self-hostable Git server for the command line. Versions 0.11.2 and below have a critical authentication bypass vulnerability that allows an attacker to impersonate any user (including admin) by "offering" the victim's public key during the SSH handshake before authenticating with their own valid key. This occurs because the user identity is stored in the session context during the "offer" phase and is not cleared if that specific authentication attempt fails. This issue has been fixed in version 0.11.3.
How severe is CVE-2026-24058?: CVE-2026-24058 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2026-24058 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (41st percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-24058?: CVE-2026-24058 affects Charm Soft Serve. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-24058?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2026-24058 have an EU (EUVD) identifier?: Yes. CVE-2026-24058 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-4129.
When was CVE-2026-24058 published?: CVE-2026-24058 was published on 2026-01-22 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:charm:soft_serve:*:*:*:*:*:go:*:*

More vulnerabilities in Charm Soft Serve

CVE-2026-30832 — Critical (CVSS 9.1): Soft Serve is a self-hostable Git server for the command line. From version 0.6.0 to before version 0.11.4, an…
CVE-2025-64522 — Critical (CVSS 9.1): Soft Serve is a self-hostable Git server for the command line. Versions prior to 0.11.1 have a SSRF vulnerability where…
CVE-2025-22130 — High (CVSS 8.8): Soft Serve is a self-hostable Git server for the command line. Prior to 0.8.2 , a path traversal attack allows existing…
CVE-2023-43809 — High (CVSS 7.5): Soft Serve is a self-hostable Git server for the command line. Prior to version 0.6.2, a security vulnerability in Soft…
CVE-2026-33353 — Medium (CVSS 6.5): Soft Serve is a self-hostable Git server for the command line. From version 0.6.0 to before version 0.11.6, an…
CVE-2026-22253 — Medium (CVSS 5.4): Soft Serve is a self-hostable Git server for the command line. Prior to version 0.11.2, an authorization bypass in the…

All CVEs affecting Charm Soft Serve →

Other CWE-289 vulnerabilities

CVE-2026-9701 — Critical (CVSS 9.8): The Eventer plugin for WordPress is vulnerable to an insecure password reset mechanism in all versions up to, and…
CVE-2025-13613 — Critical (CVSS 9.8): The Elated Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including,…
CVE-2024-56511 — Critical (CVSS 9.8): DataEase is an open source data visualization analysis tool. Prior to 2.10.4, there is a flaw in the authentication in…
CVE-2023-1803 — Critical (CVSS 9.8): Authentication Bypass by Alternate Name vulnerability in DTS Electronics Redline Router firmware allows Authentication…
CVE-2025-29266 — Critical (CVSS 9.6): Unraid 7.0.0 before 7.0.1 allows remote users to access the Unraid WebGUI and web console as root without…
CVE-2026-50627 — Critical (CVSS 9.1): The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access…

Browse all CWE-289 vulnerabilities →