Threat actors have begun probing a recently patched critical Gitea Docker flaw, with Sysdig saying it saw the first in-the-wild activity 13 days after public disclosure of CVE-2026-20896, a 9.8 severity issue that could let an internet client gain elevated access.
KEY FACTS
- Flaw CVE-2026-20896 affects Gitea Docker images through version 1.26.2.
- Cause The images trust the X-WEBAUTH-USER header from any source IP when reverse proxy login is enabled.
- Fix Version 1.26.3 removes the wildcard trust setting and makes reverse-proxy authentication opt-in.
- Exposure About 6,200 Gitea instances are internet-facing.
A security advisory said the problem stems from the Docker images shipping an app.ini template that hard-codes REVERSE_PROXY_TRUSTED_PROXIES = * by default. That setting can let a requester reach the container directly and send a custom header to impersonate a user.
Security researcher Ali Mustafa, who reported the flaw, said the documented safe value for the proxy trust setting is limited to localhost. He said the Docker image instead uses a wildcard, which makes the allowlist ineffective.
According to the report, when reverse-proxy authentication is enabled and the default trust setting remains in place, any process that can reach the Gitea HTTP port can attempt to log in as a known or guessable user name. Admin accounts are the main target.
Sysdig said the first observed activity came from a ProtonVPN IP address and appeared to be initial investigation rather than active exploitation. The company said the activity had not progressed further at the time of its disclosure.
WHY IT MATTERS
The issue can expose self-hosted code repositories and related administrative access if vulnerable containers are reachable from the internet. Users running affected Gitea Docker images need to apply the update or harden access controls promptly to reduce the risk of impersonation attempts.