cyber.hendryadrian.com
Vulnerability & Exploit · thehackernews.com

Gitea Docker Flaw CVE-2026-20896 Probed After Disclosure; Fix Available

· Original article ↗

Summary

Sysdig observed an initial probing attempt targeting CVE-2026-20896 in Gitea Docker images. The flaw could allow unauthenticated user impersonation when reverse-proxy authentication is enabled; affected versions through 1.26.2 were fixed in 1.26.3.

Key points

  • CVE-2026-20896 affects Gitea Docker images through version 1.26.2 and carries a CVSS score of 9.8.
  • The image template set REVERSE_PROXY_TRUSTED_PROXIES to "*", allowing the X-WEBAUTH-USER header to be trusted from any source IP.
  • When reverse-proxy authentication is enabled, an attacker able to reach the container's HTTP port could impersonate a user without a password or token.
  • Gitea fixed the issue in version 1.26.3 by removing the wildcard and making reverse-proxy authentication opt-in.
  • Sysdig reported detecting an initial investigation attempt 13 days after public disclosure; it said activity had not progressed to exploitation or an attack.
  • Sysdig estimated about 6,200 Gitea instances were internet-facing.

Article Details

Vulnerability Types
  • Authentication bypass
  • User impersonation
Severity
Critical (CVSS 9.8)
Affected Versions
  • Gitea Docker images through 1.26.2
Exploitation Status
reported
Exploit Availability
unknown
Patch Status
available
Workarounds
  • Set REVERSE_PROXY_TRUSTED_PROXIES to 127.0.0.0/8,::1/128 so only localhost is trusted.

Indicators of compromise

TypeIndicatorContext
IPV4159[.]26[.]98[.]241Source IP associated with the threat actor's initial investigation activity; Sysdig reported no subsequent exploitation or attack progress.

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationThreat actors reportedly probed an internet-facing Gitea Docker vulnerability by attempting to exploit its reverse-proxy authentication flaw.

CVE

CVE-2026-20896Threat actors are beginning to probe a critical Gitea Docker image flaw, CVE-2026-20896, which can let an unauthenticated attacker impersonate users by abusing the X-WEBAUTH-USER header.

People

Ali MustafaSecurity researcher credited with discovering and reporting CVE-2026-20896.Michael ClarkSenior director of threat research at Sysdig who described the observed activity as initial investigation and said it had not progressed to exploitation.

Vendors

SysdigThe issue affects Gitea Docker images through 1.26.2 and was fixed in 1.26.3 after Sysdig observed the first in-the-wild investigation attempt.

Products

GiteaThreat actors are beginning to probe a critical Gitea Docker image flaw, CVE-2026-20896, which can let an unauthenticated attacker impersonate users by abusing the X-WEBAUTH-USER header.

Related Articles