Reported by 2 outlets

Timeline

1. original reporting

   CVE-2026-20896: Gitea Docker Images Under Active Exploitation — Authentication Bypass via Single HTTP Header

   securityweek.com · 98d ago · July 8th, 2026

   Sysdig researchers are tracking active exploitation of CVE-2026-20896 (CVSS 9.8), a critical authentication bypass in Gitea's official Docker images (versions ≤1.26.2). The flaw stems from the Docker image shipping with REVERSE_PROXY_TRUSTED_PROXIES = * as the default, meaning any source IP is treated as trusted. If reverse-proxy authentication is enabled, anyone who can reach the Gitea HTTP port can send a crafted X-WEBAUTH-USER header and impersonate any user — including administrators — with no password or token required.

   Sysdig caught the first in-the-wild hit just 13 days after disclosure: a VPN-exit scanner that grabbed access. Approximately 6,200 Gitea instances are exposed to the internet per Shodan. Successful exploitation grants access to private repositories, API keys, database credentials, deploy tokens, and CI/CD configurations committed to the instance. Gitea 1.26.3 and 1.26.4 fix the issue by making reverse-proxy authentication opt-in. Standard (non-Docker) Gitea installations use a secure default and are unaffected.

   Hunting hypothesis: An unauthenticated remote attacker sends X-WEBAUTH-USER: admin to any internet-facing Gitea Docker instance with reverse-proxy auth enabled, gaining full repository access without credentials.

   Recommended action: Update all Gitea Docker deployments to ≥1.26.3 immediately. Audit for reverse-proxy authentication configurations. Restrict Gitea HTTP ports to trusted networks.

   ---

2. update from bleepingcomputer.com

   CVE-2026-20896: Gitea Docker Auth Bypass — Singapore CSA Warns of Active Exploitation

   bleepingcomputer.com · 95d ago · July 11th, 2026

   Previously covered July 8. New: Singapore's CSA has issued an active exploitation warning; Sysdig reports first in-the-wild hit 13 days after disclosure.

   Singapore's Cyber Security Agency (CSA) has warned that CVE-2026-20896 (CVSS 9.8) is being actively exploited in the wild, confirming the urgency first reported by Sysdig. CSA recommends restricting the trusted proxies setting to specific IPs and reviewing access logs. Gitea 1.26.4 is the current fixed release.