AI-generated · no human review · verify critical claims against the linked source.how it works →
Gitea Docker reverse-proxy trust-all auth bypass (X-WEBAUTH-USER impersonation), NCSC-CH escalated status to actively-exploited 2026-07-10
cve
· CVE-2026-20896
Coverage
1
first 2026-06-23 → last 2026-10-21
Latest activity
2026-07-10
Gitea Docker instances with reverse-proxy login enabled accepted a spoofed login header from anyone, and…
Peak priority
high
1 high
Targets
·
regions: europe, dach, switzerland
Sources cited
7
6 hosts
Action items (1)
Do-now tasks recorded on the entries about CVE-2026-20896, newest first. Check the date before acting on an older one.
Upgrade every Gitea Docker instance that runs with ENABLE_REVERSE_PROXY_AUTHENTICATION = true to 1.26.4, or until then set REVERSE_PROXY_TRUSTED_PROXIES to the authenticating proxy's exact address, internet-reachable instances first.
trending-vulnerabilitiesGitea Docker instances with reverse-proxy login enabled accepted a spoofed login header from anyone, and NCSC-CH rates it exploited
1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)
Initial AccessExploit Public-Facing Application
Initial Access TA0001
T1190Exploit Public-Facing Application×1
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Gitea 1.26.3 (2026-06-20) fixes a large set of security flaws and 1.26.4 (2026-06-21) adds one more, and Gitea recommends upgrading directly to 1.26.4 (Gitea, 2026-06-21). The critical flaw, CVE-2026-20896 (CVSS 9.8) (NCSC-CH Cyber Security Hub, 2026-07-10), is in the official Docker images, whose app.ini template hard-codes REVERSE_PROXY_TRUSTED_PROXIES = * instead of the documented loopback-only default (GitHub Security Advisory GHSA-f75j-4cw6-rmx4, 2026-06-21). When an administrator enables ENABLE_REVERSE_PROXY_AUTHENTICATION = true to put Gitea behind an authenticating reverse proxy, the image trusts the X-WEBAUTH-USER header from any source IP, so anyone who can reach the container's HTTP port directly can impersonate any user whose login name is known or guessable, with admin accounts the obvious targets (GitHub Security Advisory GHSA-f75j-4cw6-rmx4, 2026-06-21). Binary and self-built deployments that follow app.example.ini keep the loopback-only default and are not affected (GitHub Security Advisory GHSA-f75j-4cw6-rmx4, 2026-06-21). Version 1.26.3 removes the wildcard (The Hacker News, 2026-07-06) and makes reverse-proxy authentication opt-in and admin-configured (Gitea, 2026-06-21).
The same release fixes, among others, CVE-2026-27775, where the pre-receive hook cached the first ref's permission result and let a per-branch maintainer-edit grant escalate to full repository write (Gitea, 2026-06-21), CVE-2026-20779, a TOTP race and replay window across web login, password reset and the X-Gitea-OTP Basic-Auth surface (Gitea, 2026-06-21), and CVE-2026-22874, an incomplete SSRF protection in webhooks and migrations (Gitea, 2026-06-21). Germany's BSI issued WID-SEC-2026-2027 on 2026-06-22 rating the set "hoch" (BSI WID, 2026-06-22 · BSI WID CSAF, 2026-06-22). NCSC-CH set the exploitation status of CVE-2026-20896 to "Actively Exploited, Proof of Concept Available" on 2026-07-10 (NCSC-CH Cyber Security Hub, 2026-07-10), while the Sysdig telemetry behind the public reporting shows a first attempt that had not progressed beyond initial investigation (The Hacker News, 2026-07-06).
Triage: with reverse-proxy authentication on, a legitimate login also arrives as an X-WEBAUTH-USER header, set by the authenticating proxy, so the header alone is not the signal; the exploit is the same header on a direct connection from any other source, which signs the sender in with no password and no cookie (GitHub Security Advisory GHSA-f75j-4cw6-rmx4, 2026-06-21).
can impersonate any user whose login name is known or guessable
An attacker can exploit multiple vulnerabilities in Gitea to gain elevated privileges, impersonate users, bypass security measures, manipulate data and disclose confidential information. (translated from German)
BSI WID
Current exploitation status: Actively Exploited, Proof of Concept Available
Successful exploitation allows unauthenticated attackers to gain full administrative control of Gitea instances via a single custom HTTP header.
NCSC-CH added CVE-2026-20896 to its Cyber Security Hub on 2026-07-10 with the exploitation status "Actively Exploited, Proof of Concept Available", and names as the prerequisite a deployment on the official Docker image with reverse-proxy authentication enabled (NCSC-CH Cyber Security Hub, 2026-07-10).
The public exploitation reporting traces to Sysdig, which detected a first exploitation attempt 13 days after disclosure. Sysdig's Michael Clark told The Hacker News that the activity had "not so far progressed to any exploitation or attack progress" (The Hacker News, 2026-07-06). The Hacker News puts the number of internet-facing Gitea instances at about 6,200 (The Hacker News, 2026-07-06).
Contradiction: SecurityWeek, reporting the same Sysdig telemetry, says threat actors are exploiting the flaw to access internet-accessible instances (SecurityWeek, 2026-07-07), while Sysdig's statement to The Hacker News is that the activity had not progressed to exploitation (The Hacker News, 2026-07-06).
The earlier main text said no exploitation was reported. NCSC-CH set the flaw to "Actively Exploited, Proof of Concept Available" on 2026-07-10 (NCSC-CH Cyber Security Hub, 2026-07-10), while Sysdig, whose telemetry the public reporting rests on, told The Hacker News that the activity had not progressed to exploitation (The Hacker News, 2026-07-06). SecurityWeek reports the same telemetry as exploitation (SecurityWeek, 2026-07-07). The earlier summary and main text also presented the takeover as open to anyone who reaches the port. It works only where an administrator has enabled reverse-proxy authentication on the official Docker image and left the trusted-proxies setting at the image default, and the attacker needs a known or guessable username (GitHub Security Advisory GHSA-f75j-4cw6-rmx4, 2026-06-21). The 1.26.3 release fixes more than four flaws, and CVE-2026-27775 is a cached permission check in the pre-receive hook, not a branch-protection race (Gitea, 2026-06-21). No cited source supports an earlier claim that Gitea dominates DACH and EU public-sector DevOps.
With reverse-proxy authentication on, legitimate logins also arrive as an X-WEBAUTH-USER header, which the authenticating proxy sets; the advisory's exploit is that header sent on a direct connection from any other source, which signs the sender in as the named user with no password and no cookie (GitHub Security Advisory GHSA-f75j-4cw6-rmx4, 2026-06-21).