Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure
Summary: Sysdig observed threat actors attempting to exploit CVE-2026-20896, a critical 9.8-severity flaw in Gitea Docker images that hard-code REVERSE_PROXY_TRUSTED_PROXIES to a wildcard, letting any client reaching the container's HTTP port send an X-WEBAUTH-USER header and authenticate as any user without a password or token. The flaw affects versions through 1.26.2 and was fixed in 1.26.3, and Sysdig detected the first in-the-wild attempt 13 days after public disclosure, from ProtonVPN IP 159.26.98[.]241, which had not progressed beyond initial investigation.
What's compelling: With roughly 6,200 internet-facing Gitea instances and a default config that trusts every source IP, any admin who enabled reverse-proxy authentication without changing the template was exposed to impersonation of accounts like admin and gitea_admin - and the first probe came 13 days after disclosure.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-20896
- Related
- Critical Gitea Flaw Let Unauthenticated Attackers Read Server Files via Org-Mode Markup Cyber Risks ·⚡ Weekly Recap: Proxy Botnets, Browser Ransomware, AI Agent Tricks, Fake PoC Malware and More Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026