Gitea Vulnerability Exposes Private Container Images without Authentication
Summary: Researchers disclosed CVE-2026-27771 (CVSS 8.2) in Gitea, an open-source self-hosted version control platform, allowing unauthenticated remote attackers to pull private container images without an account or credentials. Noscope estimates the flaw affects more than 30,000 deployments across over 30 countries, went undetected for close to four years, and is fixed in Gitea 1.26.2, with Forgejo confirmed impacted and other forks treated as potentially affected until verified.
What you should know: More than 30,000 deployments in healthcare, aerospace, retail, and ISPs treated a private label on container images as protection that the registry never actually enforced for close to four years.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-27771
- Related
- Critical Gitea Flaw Let Unauthenticated Attackers Read Server Files via Org-Mode Markup Cyber Risks ·⚡ Weekly Recap: New Linux Flaw, PAN-OS Exploit, AI-Powered Attacks, OAuth Phishing and More Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026