Gitea CVE-2026-20896 Exploited in the Wild, Researchers Warn

Summary

Researchers report active exploitation of CVE-2026-20896, a critical Gitea Docker-image flaw that lets a valid username in an HTTP header bypass reverse-proxy authentication. Sysdig detected activity 13 days after disclosure; users should update.

Key points

CVE-2026-20896, rated CVSS 9.8, affects Gitea official Docker images before version 1.26.3; default settings allow connections from any source IP instead of enforcing an allowlist.
An attacker able to reach the container’s HTTP port can use a known or guessable username in a header to impersonate a user, potentially including an administrator.
Sysdig’s Michael Clark says sensors detected exploitation 13 days after public disclosure; he associated the attempt with a VPN-exit scanner.
Gitea versions 1.26.3 and 1.26.4 make reverse-proxy authentication opt-in.
Sysdig found about 6,200 Gitea instances accessible from the internet, but the number of vulnerable instances is unclear.
Successful exploitation could expose repositories, accidentally committed secrets, CI/CD configurations, and deploy keys; the article does not report that these were accessed.