LIVE · cybersecurity feed
Live wire
ASOS Breach Reveals the Risks in Customer-Facing SaaSUnpatched AhsayCBS flaws exploited to deploy webshells, mine cryptoAI Training Critical as Governance Challenges GrowUS Disrupts Chinese State-Sponsored Hacking ToolsCitrix warns admins to patch new NetScaler RCE flaw immediatelyCisco Patches a Dozen Critical VulnerabilitiesCisco warns of critical flaws allowing Nexus switch takeoverCVE-2026-21589 · Exploitation attempts against critical Atlassian flaw have begun (CVE-2026-21589)Cyber experts call on CISA to create mandatory federal OT rulesGremlin Foresight AI finds system weaknesses and verifies the fixes
cve recordcriticalexploit reported

CVE-2026-20896

Published
CVSS9.8
Severitycritical
WeaknessCWE-284
EPSS2.8%86.0th percentile
Exploited1 KEV source

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

patch window

Called exploited 3 days after disclosure.

Measured from the CVE publication date to the earliest of 1 KEV catalogue that list it.

The life of this vulnerability

  1. CVE published
  2. First KEV listing3d
  3. Last sighting2d

Gaps are compressed to equal steps. The elapsed time is printed under each.

Which catalogues call it exploited

Sources1 of 3
Listings differ by—
Strongest claimconfirmed

This rests on a single catalogue. No second catalogue corroborates the claim that it is being exploited. CIRCL is an aggregator and is not counted.

Public exploitation evidence

2 public reports collected from VulnCheck and CIRCL, first on Jul 6, 2026. Each links to its original source. We have not verified them.

Description

Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled.

References

← Back to the CVE Tracker

Our coverage of CVE-2026-20896

CVE-2026-60004critical

Hackers now exploit critical Gitea flaw in code injection attacks

A critical vulnerability in Gitea, a self-hosted Git service, is now being actively exploited by attackers, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA). The flaw, tracked as CVE-2026-60004, is a code injection vulnerability that allows an authenticated user with repository write access to execute arbitrary shell commands on affected servers.

CVE-2026-20896critical

Critical Gitea Docker Bug Under Active Exploitation Exposes Repositories and Secrets

Attackers are actively exploiting a critical vulnerability in Gitea's official Docker images, enabling them to bypass authentication and gain access to sensitive repositories and secrets. The flaw, identified as CVE-2026-20896, carries a high severity score of 9.8.

CVE-2026-20896critical

Critical Gitea Flaw Under Active Exploitation, Researchers Warn

A critical security vulnerability in the popular open-source Git service Gitea is currently being actively exploited by attackers, according to security researchers. The flaw, identified as CVE-2026-20896, allows unauthorized individuals to bypass authentication mechanisms and gain access to sensitive data, including private repositories and secrets.

CVE-2026-20896critical

Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure

Security researchers have detected malicious actors actively probing for a critical vulnerability in Gitea Docker images, just thirteen days after the issue was publicly disclosed and patched. The vulnerability, designated CVE-2026-20896, carries a severe CVSS score of 9.8, indicating a high level of risk.