Gitea Docker Auth Bypass: Patch 1.26.4, CSA Confirms

The Gitea Docker auth-bypass story shifted from “opportunistic probing” to confirmed in-the-wild access, and the vendor’s first patch had a regression that a lot of admins are about to trip over.

BleepingComputer’s Ionut Ilascu picked up the story on 2026-07-10 with two new anchor points on top of what we covered in our 2026-07-06 writeup: Sysdig researcher Michael Clark’s telemetry on the first in-the-wild use of CVE-2026-20896, and Singapore’s Cyber Security Agency issuing its own advisory. Clark’s characterization was blunt — “the first in-the-wild hit 13 days after the advisory, a VPN-exit scanner that grabbed access.” That is the exact pre-mass-exploitation window our earlier piece flagged; we are past it.

More importantly for anyone who patched last week: Gitea 1.26.3, the version we told you to run, shipped a regression. Run 1.26.4 instead.

What changed since last week

Active exploitation, not just probes. Sysdig’s writeup names a VPN-exit-node scanner as the first observed in-the-wild access — one confirmed hit past the header-probe stage, per Clark’s read. That is a small but real bump in confidence over the “opportunistic scanning” framing The Hacker News had on 2026-07-06. Still no named actor, still no confirmed post-exploitation scope — treat that gap as “not yet reported,” not “not happening.”

Singapore CSA published its own alert. CSA alert AL-2026-083 is the second national CERT-tier signal on this CVE. It doesn’t tell your SIEM anything the vendor advisory didn’t, but it’s another lever to hand your leadership when you’re asking why the Gitea box didn’t get patched this week.

1.26.3 had a regression. 1.26.4 is the fix. The Gitea maintainers shipped 1.26.4 to address a regression introduced in 1.26.3. If you patched last week to 1.26.3 you are safe from CVE-2026-20896, but you should still bump to 1.26.4 to avoid the follow-on issue. If you haven’t patched yet, skip 1.26.3 and go straight to 1.26.4.

The vendor advisory is GHSA-f75j-4cw6-rmx4. BleepingComputer’s estimate of roughly 6,200 publicly exposed Gitea instances hasn’t meaningfully moved since the 2026-07-06 telemetry — meaning the patch curve on this one is slow, in the middle of confirmed exploitation. Still not on the CISA KEV catalog at time of publication; check directly.

What to do — updated priority list

1. Bump every Gitea Docker deployment to 1.26.4. Skip 1.26.3. If you’re already on 1.26.3, still bump — the regression alone is worth the redeploy.

2. If you can’t patch this hour, override the trusted-proxy setting. Set REVERSE_PROXY_TRUSTED_PROXIES in your app.ini or environment to your real proxy CIDR (127.0.0.0/8,::1/128 for a sidecar; the actual proxy subnet otherwise). That override closes the exposure regardless of image version and survives upgrades.

3. Hunt the exposure window on any 1.26.2-or-earlier deployment that was internet-reachable after 2026-06-23. The full IR checklist is in our 2026-07-06 writeup — access-log review for X-WEBAUTH-USER headers from unexpected sources, admin-session hunting, new SSH keys and PATs, webhook tampering. Nothing changes in that pull; the confidence to prioritize it did.

4. If the hunt turns up anything, rotate. SSH deploy keys, personal access tokens, webhook secrets, on any accounts that could have been impersonated. Assume repos cloned by an attacker are gone; you can only stop the pivots forward — into CI, into deploy targets, into whatever else that Gitea authenticates to.

Priority call

Patch to Gitea Docker 1.26.4 today. Not 1.26.3 — 1.26.4. Public instances that can’t move this hour go behind a network gate or get the explicit trusted-proxy override. If your Gitea was internet-reachable on 1.26.2 or older between 2026-06-23 and today, treat it as potentially compromised and work the hunt list from our earlier piece.

The honest timeline: 13 days from disclosure to first confirmed in-the-wild hit, and now a regression in the first patch. If your image-refresh cadence is a week or longer, this is the exact scenario that costs you.

Related coverage: our 2026-07-06 Gitea Docker auth-bypass writeup has the full mechanics and IR pull, and the CVE-2026-20896 entry tracks the fixed-version and status changes.

Sources

• Ionut Ilascu. Hackers exploit critical auth bypass in Gitea Docker image. BleepingComputer, 2026-07-10.
• Gitea. GHSA-f75j-4cw6-rmx4.
• Singapore CSA. Alert AL-2026-083.
• Ravie Lakshmanan. Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure. The Hacker News, 2026-07-06.
• CISA. Known Exploited Vulnerabilities Catalog. Not listed at time of publication.