One Header Can Own a Gitea Repo Fleet

A direct line to the Gitea container turns reverse-proxy login into a fake login. If the instance is reachable outside the intended proxy path, a single username header can make it accept the attacker as that user and hand over private repos, CI/CD config, deploy keys, and secrets. The flaw affects Gitea official Docker images before 1.26.3. Researchers say exploitation started 13 days after disclosure, and internet-facing instances are exposed if direct HTTP reaches the container instead of only trusted proxy traffic. The patch changes reverse-proxy authentication to opt in, and that matters because the danger is not one stolen account page. It is a full trust break in a developer platform that can expose code and the credentials stored with it.

Part of the PlainSec briefing for 2026-07-11

Sources