Gitea Docker CVE-2026-20896: attempts to exploit 13 days after disclosure

Colleagues, I’d like to draw your attention to a cybersecurity update.

I came across a serious default-configuration flaw: in Gitea Docker images, CVE-2026-20896 allowed attackers to spoof X-WEBAUTH-USER and gain passwordless access.

The issue affected versions up to 1.26.2. In the image, REVERSE_PROXY_TRUSTED_PROXIES was set to *, so trust in the proxy extended to any source.

The fix arrived in 1.26.3: the wildcard was removed, and reverse-proxy authentication became opt-in. Sysdig observed the first probing attempt 13 days after disclosure.

Why it matters: defaults like this should be reviewed immediately, especially if the service is exposed to the internet.

Have you already checked your Gitea images and proxy settings?

#cybersecurity #Gitea #DevOps #Vulnerability