CVE-2026-20896 (CVSS 9.8): Gitea Docker Default Misconfiguration Enables Single-Header Admin Auth Bypass — Active Probing Detected Across ~6,200 Exposed Instances

A dangerous default in Gitea's official Docker image — hardcoding REVERSE_PROXY_TRUSTED_PROXIES=* in app.ini — allows any unauthenticated remote client to impersonate any user, including administrators, by injecting a crafted X-WEBAUTH-USER HTTP header. Sysdig sensors detected the first in-the-wild probing attempt 13 days after disclosure, originating from a ProtonVPN exit node, with roughly 6,200 internet-facing Gitea instances exposed. Successful exploitation yields full read/write access to all hosted repositories, CI/CD configs, deploy keys, and any secrets developers committed by accident — making this a viable supply chain pivot point; update to Gitea 1.26.3 immediately and restrict the trusted proxy list to known proxy IPs only.

Sysdig sensors detected the first in-the-wild probing attempt 13 days after disclosure, originating from a ProtonVPN exit node, with roughly 6,200 internet-facing Gitea instances exposed.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the high severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.