Threat actors are already probing a recently patched critical vulnerability in Gitea Docker images, security firm Sysdig reports.
The flaw is CVE-2026-20896, carrying a CVSS score of 9.8. The problem: the DevOps platform trusts the X-WEBAUTH-USER header from any source IP. That means an unauthenticated client on the internet can get elevated access just by sending the right header.
Security researcher Ali Mustafa, who found the bug, explains that Gitea’s Docker images ship with an app.ini template that hard-codes “REVERSE_PROXY_TRUSTED_PROXIES = *” by default. That wildcard trusts every source IP. When reverse-proxy login is enabled, anyone who can reach the container’s port can send a fake X-WEBAUTH-USER header and authenticate as any user. No password needed. No token. And if auto-registration is on, sending an admin username gives admin access.
The documented safe value for that setting should be “127.0.0.0/8,::1/128” — localhost only. But the official Docker image doesn’t use that. It uses “*” instead. So the allowlist check is basically useless.
Gitea fixed this in version 1.26.3, released late last month. The wildcard is gone, and reverse-proxy authentication is now opt-in. But Sysdig spotted the first in-the-wild probing just 13 days after the public disclosure. There are about 6,200 internet-facing Gitea instances out there.
“So far, the activities have been related to initial investigation,” said Michael Clark, senior director of threat research at Sysdig. “While we saw the first action from an IP from the ProtonVPN service… it has not so far progressed to any exploitation.” They caught it early. But that won’t stop others from trying.
