Vendor

Gitea

Vulnerabilities and advisories affecting Gitea, the self-hosted Git service, including its official Docker images.

CVEs

CVE-2026-20896

[ CRITICAL ] CVSS 9.8 EPSS 0.8% exploited-in-wild

Gitea Docker image ships permissive reverse-proxy trusted list, allowing header-based auth bypass

The Gitea Docker image up through 1.26.2 shipped with the reverse-proxy trusted-proxy list set to a wildcard, letting an unauthenticated request that sets an X-WEBAUTH-USER header authenticate as an arbitrary account. Reported by Ali Mustafa (@rz1027) in early June 2026, fixed in Gitea 1.26.3. CVSS 9.8. The Hacker News reported opportunistic scanning against exposed instances on 2026-07-06, 13 days after disclosure; roughly 6,200 internet-facing Gitea instances remained exposed at the time.

Gitea / Gitea Docker image (1.26.2 and earlier) Jun 23

Articles

~/articles/2026-07-11-gitea-docker-cve-2026-20896-sysdig-csa-1264-regression

gitea

Gitea Docker Auth Bypass: Patch 1.26.4, CSA Confirms

Sysdig confirms the first in-the-wild hit on Gitea Docker CVE-2026-20896; Singapore CSA now warns customers; 1.26.3 shipped with a regression, so run 1.26.4.

Jul 11 read →

~/articles/2026-07-06-gitea-docker-cve-2026-20896-header-auth-bypass

gitea

Gitea Docker's Auth Bypass: Probing Already Underway

The Gitea Docker image up through 1.26.2 shipped a wildcard reverse-proxy trusted list, collapsing auth to a header. Fixed in 1.26.3. The Hacker News reports opportunistic scanning 13 days after disclosure; ~6,200 exposed instances.

Jul 6 read →