CVE-2026-20896 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-20896 | CVSS 9.8 (Critical) | Exploit: PoC available

What Is It

CVE-2026-20896 is an authentication bypass vulnerability affecting the official Gitea Docker image versions up to and including 1.26.2, caused by an insecure default configuration that allows any source IP to inject trusted reverse-proxy authentication headers.

Technical Detail

The Gitea Docker image ships with REVERSE_PROXY_TRUSTED_PROXIES=* as its default setting, which instructs Gitea to trust reverse-proxy authentication headers such as X-WEBAUTH-USER from any originating IP address. When reverse-proxy authentication is enabled, an unauthenticated remote attacker can send a crafted HTTP request containing an arbitrary X-WEBAUTH-USER header directly to the Gitea service, causing the application to authenticate the request as any user, including administrators, without supplying valid credentials. Successful exploitation results in full account takeover and, depending on repository permissions and configured integrations, may lead to unauthorized code access, secrets exposure, or further lateral movement within CI/CD pipelines.

Exploitation Status

A proof-of-concept exploit is publicly available. This vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog as of July 9, 2026, and there is no confirmed evidence of active in-the-wild exploitation at this time. However, the low complexity of exploitation combined with public PoC availability significantly reduces the barrier for opportunistic attackers.

Who Is Targeting This

No specific threat actor attribution at this time. No confirmed or reported threat actor activity has been associated with this vulnerability in available intelligence sources.

What To Do

Organizations running the Gitea Docker image should immediately audit their deployment configuration and explicitly set REVERSE_PROXY_TRUSTED_PROXIES to only the specific IP addresses or CIDR ranges of legitimate reverse proxy infrastructure, replacing the wildcard default. If reverse-proxy authentication headers such as X-WEBAUTH-USER are not required, disable that authentication method entirely. Upgrade to a patched Gitea Docker image release once one is made available by the project maintainers, and monitor release notes for a version that corrects the insecure default. Network-level controls should be applied to ensure the Gitea service port is not directly reachable from untrusted networks, particularly in deployments where reverse-proxy authentication is active. Detection can be aided by reviewing application access logs for authentication events originating from IP addresses that are not designated proxy hosts, especially those presenting X-WEBAUTH-USER headers.