Gitea
Vulnerabilities and advisories affecting Gitea, the self-hosted Git service, including its official Docker images.
Gitea Code Injection Vulnerability
Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account.
Gitea Docker image ships permissive reverse-proxy trusted list, allowing header-based auth bypass
The Gitea Docker image up through 1.26.2 shipped with the reverse-proxy trusted-proxy list set to a wildcard, letting an unauthenticated request that sets an X-WEBAUTH-USER header authenticate as an arbitrary account. Reported by Ali Mustafa (@rz1027) in early June 2026, fixed in Gitea 1.26.3. CVSS 9.8. The Hacker News reported opportunistic scanning against exposed instances on 2026-07-06, 13 days after disclosure; roughly 6,200 internet-facing Gitea instances remained exposed at the time.
Forgejo Patches CVSS 9.9 Template RCE in 16.0.4
Forgejo 16.0.4 fixes CVE-2026-89094, a CVSS 9.9 critical flaw enabling remote code execution via a crafted template repository. No workaround; upgrade now.
CISA: Gitea RCE Now Exploited, Miner Payloads Confirmed
CISA has added a critical Gitea code injection flaw to the KEV catalog as attackers drop cryptominer-like payloads on unpatched self-hosted instances. Patch to version 1.27.1 now.
Gitea Patches Critical RCE, Upgrade to 1.27.1
A critical RCE in Gitea lets any repository writer plant a git hook via patch content and run shell commands as the service account. Upgrade to 1.27.1 now.
Gitea Docker Auth Bypass: Patch 1.26.4, CSA Confirms
Sysdig confirms the first in-the-wild hit on Gitea Docker CVE-2026-20896; Singapore CSA now warns customers; 1.26.3 shipped with a regression, so run 1.26.4.
Gitea Docker's Auth Bypass: Probing Already Underway
The Gitea Docker image up through 1.26.2 shipped a wildcard reverse-proxy trusted list, collapsing auth to a header. Fixed in 1.26.3. The Hacker News reports opportunistic scanning 13 days after disclosure; ~6,200 exposed instances.