cyber.hendryadrian.com
Vulnerability & Exploit · bleepingcomputer.com

Hackers Exploit Gitea Docker Image Authentication Bypass

· Original article ↗

Summary

CVE-2026-20896 lets unauthenticated attackers impersonate Gitea users via reverse-proxy authentication headers in the official Docker image. Exploitation has been observed; versions 1.26.3 and 1.26.4 fix the flaw.

Key points

  • CVE-2026-20896 affects Gitea’s official Docker image through version 1.26.2 in the default configuration.
  • The wildcard trusted-proxy setting can let unauthenticated attackers impersonate users by sending the X-WEBAUTH-USER header.
  • Sysdig reported observing in-the-wild exploitation; the article says the number of exposed Gitea instances is around 6,200, but how many are vulnerable is unclear.
  • Gitea released versions 1.26.3 and 1.26.4 to address the flaw and recommends upgrading to the latest release.
  • If an upgrade is not possible, Singapore’s cybersecurity agency advises restricting trusted proxies to specific IP addresses and reviewing access logs for suspicious activity.

Article Details

Vulnerability Types
  • Authentication bypass
Severity
Critical
Affected Versions
  • Gitea official Docker image: versions up to and including 1.26.2 in the default configuration
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available
Workarounds
  • Set REVERSE_PROXY_TRUSTED_PROXIES to specific trusted IP addresses instead of the default wildcard.

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationAttackers exploited the authentication bypass in Gitea’s official Docker image to impersonate users, including administrators.

CVE

CVE-2026-20896Hackers are actively exploiting CVE-2026-20896, a critical authentication bypass in Gitea’s official Docker image that can let attackers impersonate any user, including administrators.

People

Michael ClarkLeading security researcher at Sysdig who confirmed that exploitation began less than two weeks before public disclosure.

Vendors

GiteaHackers are actively exploiting CVE-2026-20896, a critical authentication bypass in Gitea’s official Docker image that can let attackers impersonate any user, including administrators.

Products

GiteaHackers are actively exploiting CVE-2026-20896, a critical authentication bypass in Gitea’s official Docker image that can let attackers impersonate any user, including administrators.

Countries

SingaporeGitea and Singapore’s cybersecurity agency have urged users to upgrade to fixed versions or restrict trusted proxy settings while reviewing logs for signs of compromise.

Related Articles