A critical security vulnerability has been actively exploited by hackers, allowing them to impersonate any user on a self-hosted Git service called Gitea. The issue affects deployments using the official Docker image and can be exploited even if authentication is enabled. With over 6,200 Gitea instances exposed on the public web, this flaw poses a significant risk to organizations that rely on these services.
The vulnerability, tracked as CVE-2026-20896, allows attackers to bypass authentication by trusting identity headers from any client IP address rather than only trusted reverse proxies. This means that an unauthenticated internet client can claim to be anyone, including administrators. Michael Clark, a leading security researcher at Sysdig, confirmed that exploitation of the flaw started just over two weeks ago and has already resulted in successful attacks.
Gitea is an open-source alternative to GitHub and GitLab, used for storing source code, managing pull requests, collaborating, deploying, and performing CI/CD operations. The official Docker image configured reverse-proxy authentication to trust identity headers from any client IP address, making it vulnerable to exploitation. Clark warned that this flaw can be exploited by any process that can reach the Gitea container’s HTTP port directly, without going through the intended authenticating proxy.
The vulnerability affects the official Gitea Docker images up to and including version 1.26.2 in the default configuration. Fortunately, Gitea has released versions 1.26.3 and 1.26.4 that address CVE-2026-20896 and fix additional issues introduced in previous releases. The Singaporean cybersecurity agency (CSA) has also issued a warning about the actively exploited vulnerability.
For organizations that cannot immediately upgrade to a safe version, CSA recommends restricting the REVERSE_PROXY_TRUSTED_PROXIES setting to specific trusted IP addresses instead of the default wildcard (*). Additionally, reviewing access logs for suspicious activity can help determine if a compromise has already occurred. In light of this incident, it is essential for security teams to test every layer of their environment before attackers do.
As we’ve seen in various breach and attack simulation tests, security teams often log 54% of successful attacks but alert on only 14%. The rest move through the environment unseen. To avoid falling victim to similar exploits, organizations should take proactive measures to secure their Gitea deployments, including regular updates, strict access controls, and continuous monitoring for suspicious activity.
Source: Bleeping Computer — 2026-07-10