CVE-2026-20896
CVSS 9.8 CRITICAL: gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any… EPSS 3% (85th percentile).
Vulnerabilities · 66 days ago
A direct line to the Gitea container turns reverse-proxy login into a fake login. If the instance is reachable outside the intended proxy path, a single username header can make it accept the attacker as that user and hand over private repos, CI/CD config, deploy keys, and secrets.
The flaw affects Gitea official Docker images before 1.26.3. Researchers say exploitation started 13 days after disclosure, and internet-facing instances are exposed if direct HTTP reaches the container instead of only trusted proxy traffic.
The patch changes reverse-proxy authentication to opt in, and that matters because the danger is not one stolen account page. It is a full trust break in a developer platform that can expose code and the credentials stored with it.
CVSS 9.8 CRITICAL: gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any… EPSS 3% (85th percentile).
2 sources covering this story
Hackers exploit critical auth bypass in Gitea Docker image
Hackers are actively exploiting a critical vulnerability in the official Docker image for the Gitea self-hosted Git service that allows attackers to impersonate any user, including administrators.
Critical Gitea Flaw Under Active Exploitation, Researchers Warn
Attackers are exploiting the critical Gitea vulnerability CVE-2026-20896 to bypass authentication with a single HTTP header and access vulnerable repositories and secrets.
Part of the PlainSec briefing for 2026-07-11