Threat actors have started targeting a critical Gitea Docker security flaw identified as CVE-2026-20896, as reported by Sysdig. This vulnerability, which has a CVSS score of 9.8, was disclosed just 13 days ago and is already under scrutiny by potential attackers.
Understanding the Vulnerability
The flaw in Gitea Docker images arises from the platform’s indiscriminate trust in the ‘X-WEBAUTH-USER’ header from any IP source. This oversight enables unauthorized internet clients to gain elevated access, posing a significant security risk. Security researcher Ali Mustafa, who discovered this issue, explained that the ‘app.ini’ template within Gitea’s Docker images sets ‘REVERSE_PROXY_TRUSTED_PROXIES = *’ by default. This configuration unintentionally allows any source IP to be seen as a trusted proxy.
Mustafa highlighted that with reverse-proxy login enabled, any entity capable of accessing the port could send an ‘X-WEBAUTH-USER’ header, thereby authenticating as any user without the need for a password or token. This situation is particularly concerning if auto-registration is enabled, as an admin username could permit unfettered admin access.
Configuration Missteps and Their Implications
The recommended secure setting for ‘REVERSE_PROXY_TRUSTED_PROXIES’ is limited to ‘127.0.0.0/8,::1/128’, which confines trusted proxies to the localhost. However, the Gitea Docker image in question fails to adhere to this, defaulting to a permissive ‘*’. Consequently, this bypasses crucial allowlist checks.
Admins who enable ‘ENABLE_REVERSE_PROXY_AUTHENTICATION’ without adjusting the default proxy settings inadvertently permit any HTTP client capable of reaching the container’s port to impersonate known users. According to Gitea’s advisory, this vulnerability makes admin accounts particularly vulnerable targets.
Threat Landscape and Mitigation Measures
The vulnerability affects versions up to 1.26.2, with a fix implemented in version 1.26.3, which was released at the end of last month. The update removes the ‘*’ wildcard and makes reverse-proxy authentication an opt-in feature.
Sysdig, a cloud security firm, reported the first exploitation attempt just under two weeks post-disclosure. Approximately 6,200 Gitea instances are potentially exposed on the internet. Michael Clark of Sysdig noted that initial activity, traced to an IP from the ProtonVPN service, has so far been limited to reconnaissance rather than full-blown exploitation.
The high severity of this vulnerability underscores the necessity for users to apply the latest updates promptly to safeguard their systems against further exploitation attempts.
