Thirteen days. That’s how long it took attackers to start exploiting a critical Gitea vulnerability after disclosure. No password needed. No token. One HTTP header.
The flaw is CVE-2026-20896 with a CVSS score of 9.8. It affects Gitea’s official Docker images before version 1.26.3. The problem? Default settings accept connections from any source IP instead of enforcing an allowlist. When reverse-proxy authentication is enabled, Gitea should only trust headers set by the proxy. The bug lets anyone supply a valid username in a header and impersonate that user.
Sysdig’s Michael Clark caught the first in-the-wild hit. A “VPN-exit scanner that grabbed access,” he said. The researcher who found the bug, Ali Mustafa, explained that any process reaching the container’s HTTP port directly — not through the intended authenticating proxy — can impersonate any user whose login name is known. Admin accounts are the obvious target.
What’s at stake? Everything in the repository. Source code, private repos, secrets developers accidentally committed — API keys, database credentials, deploy tokens, CI/CD config, deploy keys. Complete compromise.
Sysdig found about 6,200 Gitea instances internet-accessible. No word on how many are still vulnerable. The fix shipped in versions 1.26.3 and 1.26.4, making reverse-proxy authentication opt-in instead of default.
If you’re running Gitea, update now. This isn’t a theoretical risk — it’s being actively exploited.
