Loading vulnerability…
CVE-2026-20896 is a critical authentication bypass vulnerability affecting official Gitea Docker images up to and including version 1.26.2. The issue is caused by an insecure default configuration in the Docker image templates that sets REVERSE_PROXY_TRUSTED_PROXIES to a wildcard value, causing Gitea to trust reverse-proxy authentication headers from any source IP address instead of only from explicitly trusted proxies. When reverse-proxy authentication is enabled, an unauthenticated remote attacker can supply a forged X-WEBAUTH-USER header and be authenticated as an arbitrary user, including an administrator. The flaw is specific to the packaged Docker-image default configuration rather than the core reverse-proxy authentication design, and standard binary or self-built installations using the documented loopback-only trusted-proxy default are not affected.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (4 hidden).
This repository contains a small but functional proof-of-concept exploit for CVE-2026-20896, an authentication bypass affecting Gitea deployments described as vulnerable up to version 1.26.2 when reverse-proxy authentication is enabled and proxy trust is misconfigured. The main exploit file, CVE-2026-20896.py, is a Python script using requests and argparse. It performs a single HTTP GET to a user-supplied target URL while injecting the X-WEBAUTH-USER header with an attacker-chosen username. If the target accepts the forged reverse-proxy authentication header, the script prints the HTTP status code and enumerates cookies returned by the server, effectively helping the operator capture a valid authenticated session for the impersonated user. Repository structure is straightforward: (1) CVE-2026-20896.py is the exploit entry point; (2) Dockerfile builds a reproducible vulnerable lab based on gitea/gitea:1.26.2, enables reverse-proxy authentication, waits for the service to become healthy via /api/healthz, and creates an admin user named jbkira; and (3) README.md documents the vulnerability, exploitation workflow, lab setup, example usage, and mitigation guidance. The Dockerfile is not part of the attack itself but supports local validation and demonstrates the required vulnerable configuration. Exploit capability is limited but actionable: it does not execute code on the target, drop malware, or brute-force credentials. Instead, it abuses trust in a spoofable authentication header to impersonate an existing user and obtain session cookies. This makes it an operational web exploit PoC rather than a mere detector. The attack vector is remote web/network access to a publicly reachable Gitea instance. The main fingerprintable artifacts are the forged X-WEBAUTH-USER header, target URLs on port 3000, and the lab health endpoint /api/healthz. The exploit requires knowledge of a valid username and a target configured to honor reverse-proxy authentication from untrusted sources.
Repository contains a small standalone Python PoC and companion detector for CVE-2026-20896 affecting Gitea reverse-proxy authentication trust handling. Structure is minimal: README with usage and context, detect.py for safe vulnerability checking, poc.py for exploitation, and docker-compose.yml for a reproducible local vulnerable lab using gitea/gitea:1.26.2 on port 3000. The main exploit is poc.py: it sends an HTTP request to the normal web page /user/settings with a spoofed X-WEBAUTH-USER header, relies on the target accepting that header as trusted reverse-proxy identity, captures any issued session cookies, and writes them to browser-importable TXT and JSON files. This enables arbitrary user impersonation and browser session reuse rather than command execution. detect.py is not the exploit itself; it is a checker that compares baseline and spoofed requests to /user/settings and reports likely vulnerability conditions. The docker-compose file intentionally enables reverse-proxy authentication while leaving trusted proxies at the vulnerable default/wildcard behavior described in the comments, making the lab exploitable. Overall, this is a real operational web-session impersonation PoC for Gitea, not just a README or pure detector.
Repository contains a small standalone Python proof-of-concept and a companion detection script for CVE-2026-20896 affecting Gitea official Docker images up to 1.26.2. The vulnerability is not a memory corruption bug but a web authentication trust failure caused by the Docker image default REVERSE_PROXY_TRUSTED_PROXIES = * combined with enabled reverse-proxy authentication. The PoC in poc.py sends normal HTTP requests to a protected page (/user/settings) and repeats the request with a spoofed X-WEBAUTH-USER header. If the target trusts the header from any source IP, Gitea creates or authenticates the named user and returns the protected page, demonstrating arbitrary user impersonation and potential admin takeover. The exploit is operational but simple: no shell payload, just authenticated session hijacking through header spoofing. detect.py is a safer checker that compares baseline and spoofed responses to determine likely vulnerability without intentionally impersonating a real user. docker-compose.yml provides a reproducible vulnerable lab using gitea/gitea:1.26.2 on port 3000 with reverse-proxy authentication and auto-registration enabled, intentionally inheriting the insecure wildcard trusted-proxy default. Overall structure: README with vulnerability explanation and usage, poc.py for exploitation, detect.py for detection, and docker-compose.yml for local reproduction.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
119 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical reverse-proxy authentication bypass vulnerability in Gitea Docker images mentioned as background context.
A critical authentication bypass vulnerability in Gitea official Docker images caused by the default REVERSE_PROXY_TRUSTED_PROXIES=* setting, allowing unauthenticated remote attackers to impersonate arbitrary users via the X-WEBAUTH-USER header when reverse-proxy authentication is enabled.
An authentication bypass vulnerability in Gitea related to reverse proxy authentication trust configuration, where supplying the X-WEBAUTH-USER header can result in unauthorized login when trusted proxies are overly permissive.
A critical authentication bypass in Gitea official Docker images caused by an unsafe default reverse proxy trust configuration that allows unauthenticated attackers to forge headers and impersonate arbitrary users, including administrators.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.