Critical Vulnerability Exploited in Gitea Docker Image, Leaving Thousands of Instances at Risk
A severe security vulnerability in the official Docker image for Gitea, a popular self-hosted Git service alternative to GitHub and GitLab, has been actively exploited by hackers. The flaw, tracked as CVE-2026-20896, allows attackers to impersonate any user, including administrators, on affected deployments using the default configuration.
The vulnerability is an authentication bypass issue that arises from Gitea’s official Docker image being configured to trust identity headers from any client IP address rather than only from trusted reverse proxies. This means that an unauthenticated internet client can claim to be anyone they choose by manipulating a specific header, X-WEBAUTH-USER. No password or token is required; one compromised header is all it takes for an attacker to gain unauthorized access.
Sysdig security researcher Michael Clark confirmed that exploitation of the flaw began less than two weeks before its public disclosure, and there are approximately 6,200 Gitea instances exposed on the public web. The implications are significant: any process that can reach the Gitea container’s HTTP port directly – not through an intended authenticating proxy – can impersonate any user whose login name is known or guessable. Admin accounts are naturally the most coveted targets.
The CVE-2026-20896 bug affects the official Gitea Docker images up to and including version 1.26.2 in their default configuration. Fortunately, the maintainers have released versions 1.26.3 and 1.26.4 that address this critical issue. However, these newer versions also introduce additional issues, so it is recommended that users upgrade straight to the latest release.
For those who cannot immediately upgrade, Singapore’s cybersecurity agency (CSA) advises restricting the REVERSE_PROXY_TRUSTED_PROXIES setting to specific trusted IP addresses instead of the default wildcard (*). Reviewing access logs for any suspicious activity to determine if a compromise has already occurred is also crucial.
The incident serves as a reminder that even with the best security measures in place, vulnerabilities can still be exploited. It highlights the importance of keeping software up-to-date and regularly reviewing configurations to ensure they align with security best practices. The takeaway is clear: only by staying vigilant and proactive can we prevent attacks from succeeding unnoticed.
Source: Bleeping Computer — 2026-07-10