Hackers exploit critical auth bypass in Gitea Docker image

Attackers are actively exploiting a critical authentication bypass flaw in the official Docker image of the Gitea self-hosted Git service. The issue lets unauthenticated outsiders impersonate any user, including administrators.

Exploitation of CVE-2026-20896 began less than two weeks after public disclosure. Michael Clark, lead security researcher at Sysdig, reported that in-the-wild activity started 13 days after the advisory. Sysdig sensors recorded the first hit originating from a VPN-exit scanner that leveraged the flaw to gain access.

The vulnerability affects deployments running the default configuration that enables reverse proxy authentication headers such as X-WEBAUTH-USER. Gitea’s official Docker image ships with the setting REVERSE_PROXY_TRUSTED_PROXIES=*, which causes the application to trust the X-WEBAUTH-USER header from any source IP address. Consequently, any unauthenticated client on the internet can assume the identity of any user whose login name is known or can be guessed.

Approximately 6,200 Gitea instances are exposed on the public web. It remains unclear how many run the vulnerable default configuration. The flaw is present in official Gitea Docker images up to and including version 1.26.2.

Gitea is an open-source self-hosted alternative to GitHub and GitLab. Organizations rely on it to store source code, manage pull requests, collaborate on projects, deploy applications, and run CI/CD operations. Successful impersonation can give attackers access to repositories, secrets, API keys, and credentials.

Gitea has released patched versions that eliminate the bypass. Versions 1.26.3 and 1.26.4 address CVE-2026-20896. The maintainer recommends upgrading directly to the latest release, which also fixes an additional issue and a regression introduced in 1.26.3. In the patched releases, reverse-proxy authentication is now opt-in rather than enabled by default.

Singapore’s cybersecurity agency has warned of active exploitation and issued mitigation guidance. If immediate upgrading is not possible, the CSA recommends restricting the REVERSE_PROXY_TRUSTED_PROXIES setting to specific trusted IP addresses instead of the wildcard *. The agency also advised organizations to review access logs for suspicious activity that could indicate a prior compromise.

The maintainer previously shared reproduction steps warning that "any process that can reach the Gitea container's HTTP port directly - not through the intended authenticating proxy - can impersonate any user whose login name is known or guessable. Admin accounts (admin, gitea_admin, etc.) are the obvious targets."