Critical Gitea Flaw Under Active Exploitation, Researchers Warn

Key Points:

• A critical vulnerability (CVE-2026-20896) in Gitea’s reverse-proxy authentication mechanism is actively being exploited, allowing attackers to bypass authentication by providing a valid username via a single HTTP header.
• This flaw affects Gitea Docker images prior to version 1.26.3, potentially compromising approximately 6,200 internet-accessible instances, with risks including unauthorized access to repositories and sensitive data.
• Immediate action is recommended: users should update their Gitea deployments to versions 1.26.3 or 1.26.4, where reverse-proxy authentication is now an opt-in feature.

Technical Details: CVE-2026-20896 has a CVSS score of 9.8 and can be exploited without credentials by manipulating HTTP headers, leading to unauthorized access.

MITRE ATT&CK Techniques: None mentioned

IOCs Mentioned: None mentioned