Gitea Docker Images Trust Spoofed Logins by Default
Fresh Gitea Docker deployments can expose login trust to anyone who can reach the port. The shipped default treats a reverse-proxy header as proof of identity from any source, so the weak point is the image’s trust boundary, not just an admin’s configuration mistake.
Sysdig says threat actors started probing CVE-2026-20896 13 days after disclosure. The flaw affects Gitea Docker images through 1.26.2 and was fixed in 1.26.3, after the default wildcard trust setting was removed and reverse-proxy authentication was made opt-in.
The practical risk is that “behind a reverse proxy” is not enough if the container is reachable directly on the network. Any deployment that leaves the default trust list in place can be impersonated through X-WEBAUTH-USER, including admin accounts, and that broken trust model is already attracting attention.