Critical Gitea Flaw Under Active Exploitation, Researchers Warn
A critical vulnerability (CVE-2026-20896) in Gitea's reverse-proxy authentication mechanism is being actively exploited, allowing attackers to bypass authentication with a single HTTP header.
Threat actors are actively exploiting a critical vulnerability in Gitea, a popular open-source Git service, to gain unauthorized access to repositories and sensitive secrets. The flaw, tracked as CVE-2026-20896, carries a CVSS score of 9.8 and allows for authentication bypass using a single HTTP header.
This vulnerability specifically affects Gitea's official Docker images prior to version 1.26.3. The issue arises because the default settings in these older Docker images permit connections from any source IP address, rather than enforcing an allowlist. When Gitea is deployed behind a proxy, it should ideally trust only headers set by that proxy when reverse-proxy authentication is enabled. However, due to this defect, any entity capable of sending a valid username in an HTTP header to a vulnerable instance can impersonate any user whose login name is known or guessable, with administrative accounts being prime targets.
Security researcher Ali Mustafa, credited with discovering the bug, explained that the exploit requires an attacker to have network access to the Gitea container's HTTP port, bypassing the intended authenticating proxy. Michael Clark, Sr. Director of Threat Research at Sysdig, noted that exploitation began just 13 days after the vulnerability's public disclosure, with initial attempts linked to a "VPN-exit scanner that grabbed access."
Sysdig's research identified approximately 6,200 Gitea instances accessible from the internet, though the exact number of vulnerable deployments remains unclear. The successful exploitation of CVE-2026-20896 could lead to a complete compromise of all code and secrets stored within a Gitea instance. This includes private repositories, committed API keys, database credentials, deploy tokens, CI/CD configurations, and deploy keys.
A patch has been released in Gitea versions 1.26.3 and 1.26.4, which makes the reverse-proxy authentication feature opt-in rather than enabled by default. Organizations using Gitea are strongly advised to update their deployments to the latest versions as soon as possible to mitigate the risk of unauthorized access and data compromise.
This incident highlights the ongoing threat posed by vulnerabilities in widely used development tools and platforms. The rapid exploitation of CVE-2026-20896 underscores the importance of prompt patching and security monitoring for code repositories and collaboration platforms, which often house highly sensitive intellectual property and credentials.