Skip to content
feed: live
>_0dayNews
← All vendors
Vendor

Gitea

Vulnerabilities and advisories affecting Gitea, the self-hosted Git service, including its official Docker images.

1 CVEs4 articlesRSS
CVEs
CVE-2026-20896
[ CRITICAL ]CVSS 9.8EPSS 2.8%exploited-in-wild

Gitea Docker image ships permissive reverse-proxy trusted list, allowing header-based auth bypass

The Gitea Docker image up through 1.26.2 shipped with the reverse-proxy trusted-proxy list set to a wildcard, letting an unauthenticated request that sets an X-WEBAUTH-USER header authenticate as an arbitrary account. Reported by Ali Mustafa (@rz1027) in early June 2026, fixed in Gitea 1.26.3. CVSS 9.8. The Hacker News reported opportunistic scanning against exposed instances on 2026-07-06, 13 days after disclosure; roughly 6,200 internet-facing Gitea instances remained exposed at the time.

Gitea / Gitea Docker image (1.26.2 and earlier)
Articles
~/articles/2026-08-26-gitea-rce-kev-active-exploitation-cryptominer
CISA: Gitea RCE Now Exploited, Miner Payloads Confirmed
● Breaking
gitea

CISA: Gitea RCE Now Exploited, Miner Payloads Confirmed

CISA has added a critical Gitea code injection flaw to the KEV catalog as attackers drop cryptominer-like payloads on unpatched self-hosted instances. Patch to version 1.27.1 now.

read →
~/articles/2026-07-29-gitea-critical-rce-git-hook-1-27-1
Gitea Patches Critical RCE, Upgrade to 1.27.1
gitea

Gitea Patches Critical RCE, Upgrade to 1.27.1

A critical RCE in Gitea lets any repository writer plant a git hook via patch content and run shell commands as the service account. Upgrade to 1.27.1 now.

read →
~/articles/2026-07-11-gitea-docker-cve-2026-20896-sysdig-csa-1264-regression
Gitea Docker Auth Bypass: Patch 1.26.4, CSA Confirms
gitea

Gitea Docker Auth Bypass: Patch 1.26.4, CSA Confirms

Sysdig confirms the first in-the-wild hit on Gitea Docker CVE-2026-20896; Singapore CSA now warns customers; 1.26.3 shipped with a regression, so run 1.26.4.

read →
~/articles/2026-07-06-gitea-docker-cve-2026-20896-header-auth-bypass
Gitea Docker's Auth Bypass: Probing Already Underway
gitea

Gitea Docker's Auth Bypass: Probing Already Underway

The Gitea Docker image up through 1.26.2 shipped a wildcard reverse-proxy trusted list, collapsing auth to a header. Fixed in 1.26.3. The Hacker News reports opportunistic scanning 13 days after disclosure; ~6,200 exposed instances.

read →