Cybersecurity researchers are sounding the alarm about a critical flaw in Gitea, an open-source platform used for hosting git repositories. Threat actors have been actively exploiting this vulnerability, which allows unauthorized access to internet-accessible instances of Gitea.
The issue affects all versions of Gitea prior to 1.26.3, and is tracked as CVE-2026-20896 with a CVSS score of 9.8. This means that hackers can gain full control over affected systems without needing any authentication credentials other than a valid username. According to researchers at Sysdig, the vulnerability exists because Gitea’s default settings allow connections from any source IP address, rather than enforcing an allowlist.
When reverse-proxy authentication is enabled in Gitea, it should only trust headers set by the proxy. However, due to this flaw, anyone who can provide a valid username in a header can connect to a vulnerable instance and bypass authentication altogether. This means that admin accounts are particularly at risk, as hackers may attempt to compromise these high-privilege accounts.
The researchers at Sysdig have reported catching an in-the-wild exploit of the vulnerability just 13 days after public disclosure. The exploit was associated with a VPN-exit scanner that was used to grab access to vulnerable instances. According to their findings, approximately 6,200 Gitea instances are accessible from the internet, although it’s unclear how many of these are actually vulnerable.
The successful exploitation of this vulnerability could lead to the complete compromise of all code and secrets stored in Gitea. This includes private repositories, API keys, database credentials, deploy tokens, CI/CD config, and deploy keys. As such, users are advised to update their Gitea deployments as soon as possible to prevent potential attacks.
The fact that this vulnerability has been actively exploited by threat actors within a short period of time highlights the importance of prioritizing security updates and patches in open-source platforms like Gitea. In particular, developers should be cautious when using default settings or relying on reverse-proxy authentication without proper configuration.
In light of this incident, it’s essential for organizations to take proactive steps to secure their Gitea instances. This includes regularly updating their deployments with the latest security patches and ensuring that all accounts, including admin accounts, are properly secured. By taking these precautions, users can minimize the risk of falling victim to this critical vulnerability.
Source: SecurityWeek — 2026-07-07