One Header, Full Admin: Attackers Exploit Critical Auth Bypass in Gitea Docker Images

TL;DR

what: CVE-2026-20896, a critical authentication bypass in the default configuration of official Gitea Docker images through 1.26.2, is under active exploitation via spoofed X-WEBAUTH-USER reverse-proxy headers.

impact: Attackers can impersonate any user, including administrators, with no password or token, giving them full control of source code, CI secrets, and everything downstream of the compromised Git server.

fix: Upgrade to Gitea 1.26.4 (1.26.3 fixed the flaw but introduced a regression) and lock REVERSE_PROXY_TRUSTED_PROXIES to explicit trusted IPs instead of a wildcard.

who: Anyone running the official Gitea Docker image, especially the roughly 6,200 instances reachable from the public internet, and any org whose CI/CD pipeline trusts that Gitea as a source of truth.

TL;DR

fix: Upgrade to Gitea 1.26.4 (1.26.3 fixed the flaw but introduced a regression) and lock REVERSE_PROXY_TRUSTED_PROXIES to explicit trusted IPs instead of a wildcard.

One Header, Full Admin: Attackers Exploit Critical Auth Bypass in Gitea Docker Images

One Header, Full Admin: Attackers Exploit Critical Auth Bypass in Gitea Docker Images

Other newsrooms on this story

Related reading

Hackers exploit critical auth bypass in Gitea Docker image

Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure

Critical Gitea Flaw Under Active Exploitation, Researchers Warn

Gitea Vulnerability Exposed 30,000 Deployments to Attacks

Gitea Vulnerability Exposes Private Container Images without Authentication

Gogs patches critical zero-day enabling remote code execution

Other newsrooms on this story

Related reading

Hackers exploit critical auth bypass in Gitea Docker image

Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure

Critical Gitea Flaw Under Active Exploitation, Researchers Warn

Gitea Vulnerability Exposed 30,000 Deployments to Attacks

Gitea Vulnerability Exposes Private Container Images without Authentication

Gogs patches critical zero-day enabling remote code execution