CVE-2026-20896
CVSS 9.8 CRITICAL: gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any… EPSS 3% (85th percentile).
Vulnerabilities & Exploits · Zero-Day Exploit
Shadowserver says more than 8,300 internet-facing Gitea instances are still exposed to active remote code execution attacks through CVE-2026-20896. The issue sits in the Docker image’s default reverse-proxy trust setup, which makes the app accept identity and source headers as if they came through a trusted proxy.
In plain terms, Gitea can be tricked into believing a request arrived through an internal proxy when it did not, so an outside host can impersonate where the traffic came from and who sent it. That breaks the boundary many deployments assume the proxy enforces, and on exposed instances that can move the problem from account spoofing into code execution.
For operators running Gitea in Docker, the exposure is in the deployment model as much as the version number: anything internet-reachable with that default trust path inherits the risk until it is corrected. Shadowserver’s count shows the window is still wide open while exploitation is underway.
1 source · Aug 28
CVSS 9.8 CRITICAL: gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any… EPSS 3% (85th percentile).
BleepingComputer
Over 8,300 Gitea servers vulnerable to code execution attacks
Over 8,300 Internet-exposed Gitea instances are still unpatched against a critical security flaw exploited in ongoing remote code execution attacks, according to cybersecurity watchdog Shadowserver.
originalPart of the PlainSec briefing for 2026-08-29
Every edition of this story: Gitea Docker Defaults Open a Route to RCE