Attackers are actively exploiting a critical vulnerability in Gitea's official Docker images, enabling them to bypass authentication and gain access to sensitive repositories and secrets. The flaw, identified as CVE-2026-20896, carries a high severity score of 9.8.
The vulnerability specifically affects Gitea Docker images prior to version 1.26.3. Researchers from Sysdig observed the first exploitation attempts in the wild approximately 13 days after the vulnerability was disclosed.
The exploit involves sending a single, specially crafted HTTP header. This header allows an attacker to impersonate any user, including administrators, by leveraging an insecure default configuration within the official Gitea Docker images.
The root cause of the issue lies in the default configuration of the `REVERSE_PROXY_TRUSTED_PROXIES` setting. In the affected Docker images, this is set to a wildcard (`*`), meaning that any IP address is treated as a trusted reverse proxy. This misconfiguration allows any entity that can reach the Gitea container's HTTP port to send the `X-WEBAUTH-USER` header and authenticate as a legitimate user without needing a password or token.
This vulnerability is specific to the official Gitea Docker images. Standard Gitea installations or self-built instances that do not use these default Docker configurations are not affected, provided they adhere to secure default settings which typically restrict trusted proxies to the local machine.
The potential impact of a successful exploitation is significant. Attackers can gain access to private repositories, committed secrets such as API keys and database credentials, CI/CD configurations, and deploy keys.
Gitea versions 1.26.3 and 1.26.4 have addressed this vulnerability. In these updated versions, reverse-proxy authentication has been made an opt-in feature, and the default configuration no longer trusts all IP addresses.
While the exact number of vulnerable systems remains unknown, a Shodan query identified approximately 6,200 Gitea instances exposed to the internet. Users are strongly advised to update their Gitea Docker images immediately to the latest patched versions to protect their source code and sensitive data.
