Gitea’s official Docker images shipped with a default configuration that let any source IP address impersonate any user, including an administrator, and the flaw is now drawing the first probing attempts from outside attackers.
The vulnerability, tracked as CVE-2026-20896 with a CVSS score of 9.8, lived in the Docker template files Gitea publishes for its self-hosted Git platform. When an administrator enabled reverse proxy authentication, a common setup for teams running Gitea behind a corporate login gateway, the Docker image’s default trusted proxy setting accepted the identity claimed in an X-WEBAUTH-USER header from any source, rather than only from the local loopback address the documentation described. Anyone who could reach the container’s HTTP port could send that header naming an admin account and be logged in immediately, with no password or second factor required. Gitea fixed the flaw in version 1.26.3, released in late June, making reverse proxy authentication opt-in rather than a trust everyone default, according to Gitea’s own security advisory.
Cloud security firm Sysdig said its threat research team detected the first in-the-wild attempt to probe the flaw within 13 days of disclosure. Michael Clark, Sysdig’s senior director of threat research, said the activity so far has been consistent with initial reconnaissance rather than a completed attack. Sysdig separately estimated roughly 6,200 Gitea instances are reachable from the open internet, the exposed population this default configuration touches.
The deeper lesson for platform teams is that zero trust fails quietly at the container layer, not just the network layer. A configuration file that trusts a client supplied header, instead of a verified certificate or signed token, recreates the implicit trust zero trust is meant to eliminate, inside a tool engineering teams often treat as internal and low risk. CyberTech has covered the same pattern in a flaw that let malicious repositories harvest developer cloud credentials through Amazon’s Q Developer tool. Teams running self-hosted Gitea should confirm they are on version 1.26.3 or later and explicitly review their REVERSE_PROXY_TRUSTED_PROXIES setting rather than trust the shipped default.
Source: Gitea Security Advisory
