Gitea Docker Reverse-Proxy Authentication Bypass

VULNERABILITY OVERVIEW

Gitea's official Docker image hard-codes REVERSE_PROXY_TRUSTED_PROXIES=* in app.ini, causing the platform to trust the X-WEBAUTH-USER HTTP header from any source IP when reverse-proxy authentication is enabled. Any unauthenticated attacker who can reach the Gitea port can impersonate any user — including administrators — with a single HTTP header, no password or token required. Sysdig confirmed active exploitation attempts began 13 days after public disclosure, targeting approximately 6,200 internet-accessible Gitea instances; a public PoC and detector tool are available on GitHub from the bug reporter. Successful exploitation exposes all code repositories, secrets, CI/CD credentials, and deploy keys stored in the instance, making it a high-value supply-chain attack vector.

CVSS BREAKDOWN

CITATIONS

• → https://thehackernews.com/2026/07/threat-actors-probe-gitea-docker-flaw.html
• → https://blog.gitea.com/release-of-1.26.3-and-1.26.4/
• → https://github.com/rz1027/CVE-2026-20896
• → https://www.securityweek.com/critical-gitea-flaw-under-active-exploitation-researchers-warn/