Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure

Overview

Threat actors have been observed attempting to exploit a recently patched critical security flaw in Gitea Docker images, according to Sysdig. The vulnerability, tracked as CVE-2026-20896 (CVSS score: 9.8), stems from the DevOps platform trusting the X-WEBAUTH-USER header from any source IP address, effectively allowing an unauthenticated internet client to gain elevated access.

Technical Details

Security researcher Ali Mustafa (@rz1027), who discovered and reported the flaw, explained that Gitea Docker images ship an app.ini template that hard-codes REVERSE_PROXY_TRUSTED_PROXIES = * by default. The documented safe value is 127.0.0.0/8,::1/128, meaning only localhost is trusted. However, the official Docker image uses the wildcard, effectively disabling the allowlist check.

When an admin enables ENABLE_REVERSE_PROXY_AUTHENTICATION = true and leaves the trusted-proxies setting at its default, any process that can reach the Gitea container's HTTP port directly can impersonate any user by sending an X-WEBAUTH-USER header. Admin accounts are the obvious targets. With auto-registration enabled, attackers can also create new privileged accounts.

Exploitation in the Wild

Sysdig detected the first in-the-wild exploitation attempt 13 days after public disclosure. The initial activity originated from a ProtonVPN exit node (IP: 159.26.98[.]241) and involved reconnaissance scanning. There are approximately 6,200 internet-facing Gitea instances potentially vulnerable.

Michael Clark, senior director of threat research at Sysdig, stated: "So far, the activities have been related to initial investigation by the threat actor. While we saw the first action from an IP from the ProtonVPN service, it has not so far progressed to any exploitation or attack progress."

Affected Versions and Patch

The vulnerability affects Gitea Docker images versions before and including 1.26.2. It has been addressed in version 1.26.3, released on June 21, 2026. The fix removes the wildcard and makes reverse-proxy authentication opt-in.

Mitigation

Organizations should immediately upgrade to Gitea 1.26.3 or later. Administrators must explicitly set REVERSE_PROXY_TRUSTED_PROXIES to 127.0.0.0/8,::1/128 and disable ENABLE_REVERSE_PROXY_AUTHENTICATION unless absolutely necessary. Network-level controls should restrict access to Gitea HTTP ports to authorized reverse proxies only. Audit logs for unauthorized X-WEBAUTH-USER header usage are also recommended.