Loading story…
Threat actors have begun probing a critical authentication bypass in official Gitea Docker images, tracked as CVE-2026-20896, shortly after public disclosure and patch release. The flaw stems from a default configuration that sets REVERSE_PROXY_TRUSTED_PROXIES = *, causing Gitea to trust the X-WEBAUTH-USER header from any source IP when reverse-proxy authentication is enabled. An attacker that can directly reach the Gitea HTTP service can impersonate any existing user without a password or session cookie, including administrators, and may also create accounts if auto-registration is enabled.
The issue affects Gitea Docker image deployments through 1.26.2 and was fixed in 1.26.3 and later by removing wildcard proxy trust and making reverse-proxy authentication opt-in. Researchers reported the first observed in-the-wild activity 13 days after disclosure, with reconnaissance tied to ProtonVPN-associated infrastructure, while public proof-of-concept details have increased the risk of broader exploitation. With roughly 6,200 internet-facing Gitea instances estimated to be exposed, organizations are being urged to upgrade immediately and review systems for unauthorized access.
See which actors are running it and whether you're in range.
7 events from the most recent confirmed update back to the earliest known activity.
Singapore’s Cyber Security Agency warned organizations to upgrade Gitea or restrict REVERSE_PROXY_TRUSTED_PROXIES to trusted IPs and review logs for signs of compromise following active exploitation of CVE-2026-20896.
Sysdig reported the first in-the-wild exploitation attempt against CVE-2026-20896 13 days after public disclosure. The observed activity appeared limited to initial reconnaissance from a ProtonVPN-associated IP address.
Gitea fixed CVE-2026-20896 by removing wildcard trusted proxies and making reverse-proxy authentication opt-in in updated Docker image releases. The flaw affected official Docker image deployments through version 1.26.2.
Lupovis observed coordinated scanning and exploitation activity targeting CVE-2026-8451 within 24 hours of its disclosure and proof-of-concept release. Researchers warned the flaw could support initial access, privilege escalation, lateral movement, and data exfiltration.
Citrix publicly disclosed and patched CVE-2026-8451, a NetScaler memory overread vulnerability affecting ADC and Gateway devices configured as a SAML identity provider. On the same day, WatchTowr published technical details and a proof of concept for the flaw.
Gitea disclosed CVE-2026-20896, an authentication bypass in official Docker images caused by trusting the X-WEBAUTH-USER header from any source IP when reverse-proxy authentication is enabled. The advisory identified verified affected versions including Docker image 1.26.2 and warned that attackers could impersonate arbitrary users, including administrators.
A remote code execution vulnerability in crawl4ai's Docker API server was fixed in version 0.9.0 by forbidding dangerous request-supplied Chromium launch arguments in untrusted request bodies. The issue affected the /crawl, /crawl/stream, and /crawl/job endpoints and was especially severe because the Docker API was unauthenticated by default.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
11 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcelinuxsecurity.com
Open sourcebleepingcomputer.com
Open sourcesecurityaffairs.com
Open sourcedarkreading.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Gitea disclosed two severe vulnerabilities affecting repository automation and artifact handling. **CVE-2026-58424** is a remotely exploitable authorization flaw with a CVSS score of **8.9** that can bypass permanent fork pull-request workflow approval gates, undermining branch protection and merge controls. The issue is tied to permission weaknesses including `CWE-285`, `CWE-732`, and `CWE-863`, and fixes are referenced in Gitea releases **1.26.3** and **1.26.4**. Administrators are advised to harden pull-request workflow approvals, enforce strict branch protections, and review workflow logs for signs of bypass attempts. Gitea also addressed **CVE-2026-58426**, a critical signed-URL validation flaw in **Gitea Actions Artifacts V4** with a CVSS score of **9.6**. The `CWE-347` weakness stems from HMAC ambiguity and can allow cross-repository artifact reads and cross-task upload-state writes, creating a path for unauthorized access to build artifacts and tampering with task state. The recommended response is to upgrade to a fixed Gitea release, cited as **1.26.2**, and audit artifact access controls and upload-state integrity. Separately, Canada’s Centre for Cyber Security issued an advisory urging OpenSSH users to upgrade versions prior to **10.4**, but that notice appears unrelated to the Gitea flaws.
Jul 7, 2026
A critical Gitea authorization bypass tracked as **`CVE-2026-58443`** allows a **public-only** access token with **`write:repository`** scope to push commits into a private repository under specific pull request conditions. The flaw affects Gitea releases up to and including **`v1.26.4`** and was fixed in **`v1.27.0`**. Researchers said the issue lies in the pull request update endpoint, where Gitea checks the token’s public-only restriction against the public base repository but fails to enforce that restriction again when operating on the private head repository. The bug can be abused to perform unauthorized server-side merges or rebases into a private pull request head branch, and those writes may also trigger **Gitea Actions** workflows on the private repository if Actions is enabled. Public reporting included a technical analysis and a working proof-of-concept, though no confirmed in-the-wild exploitation was cited. Administrators were urged to upgrade to **`v1.27.0`**, audit and rotate or revoke public-only tokens with write permissions, review public-to-private pull request relationships, and inspect recent private repository pushes and Actions logs for suspicious activity.
Jul 21, 2026
Gitea has patched a critical remote code execution flaw, **CVE-2026-60004**, affecting versions `1.17` through `1.27.0`, after researchers showed that attacker-controlled patch content sent to the `POST /api/v1/repos/{owner}/{repo}/diffpatch` endpoint could be turned into a malicious Git hook and executed as the Gitea service account. The bug carries a **CVSS 9.8** rating and stems from patch application inside a shared bare temporary clone, where Git's three-way fallback can activate the planted hook; exploitation also depends on **Git 2.32 or later**. Gitea fixed the issue in **version 1.27.1** and said its cloud instances would be upgraded automatically.
Aug 27, 2026