CVE Tools
Track your stack

Hackers exploit critical auth bypass in Gitea Docker image

BleepingComputerBy Bill Toulas

Reported exploitedGitea Docker image

Our summary

Attackers are actively exploiting a critical authentication bypass flaw in the official Docker image for Gitea, a self-hosted Git service. The vulnerability, tracked as CVE-2026-20896, allows unauthenticated users to impersonate any account—including admin—by manipulating the X-WEBAUTH-USER header. This affects deployments using the default configuration that trusts this header from any IP address. Security researchers confirmed real-world exploitation began just days after the advisory was issued. Gitea has released patched versions 1.26.3 and 1.26.4, urging all users to update immediately.

Read at BleepingComputer

BleepingComputer publishes this story on its own site; we link to it rather than reprint it.

  1. BleepingComputerOver 8,300 Gitea servers vulnerable to code execution attacksCVE-2026-20896
  2. BleepingComputerHackers now exploit critical Gitea flaw in code injection attacksCVE-2026-20896
  3. SecurityWeekCISA Warns of Exploited Gitea VulnerabilityCVE-2026-20896
  4. The Hacker NewsCritical Gitea Flaw Let Unauthenticated Attackers Read Server Files via Org-Mode MarkupCVE-2026-20896
  5. SecurityWeekCritical Gitea Flaw Under Active Exploitation, Researchers WarnCVE-2026-20896
  6. The Hacker NewsThreat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After DisclosureCVE-2026-20896
  7. The Hacker News⚡ Weekly Recap: Proxy Botnets, Browser Ransomware, AI Agent Tricks, Fake PoC Malware and MoreCVE-2026-20896
  8. Daily CyberSecurity (securityonline.info)Critical Gitea Security Flaws Expose Servers to TakeoverCVE-2026-20896

Worried this affects your company?

Discuss a security assessment of your internet-facing systems. Scope agreed before testing.

Check my exposure

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store