Shadowserver says more than 8,300 internet-facing Gitea instances are still exposed to active remote code execution attacks through CVE-2026-20896. The issue sits in the Docker image’s default reverse-proxy trust setup, which makes the app accept identity and source headers as if they came through a trusted proxy.
In plain terms, Gitea can be tricked into believing a request arrived through an internal proxy when it did not, so an outside host can impersonate where the traffic came from and who sent it. That breaks the boundary many deployments assume the proxy enforces, and on exposed instances that can move the problem from account spoofing into code execution.
For operators running Gitea in Docker, the exposure is in the deployment model as much as the version number: anything internet-reachable with that default trust path inherits the risk until it is corrected. Shadowserver’s count shows the window is still wide open while exploitation is underway.