A critical authentication bypass vulnerability in Gitea's Docker images lets attackers take over any account -- including admin -- by sending a single HTTP header. With a CVSS 9.8 rating and active exploitation underway, every Gitea self-hoster needs to patch immediately.

Background

Gitea is one of the most popular self-hosted Git platforms, trusted by thousands of organizations for hosting private source code, CI/CD pipelines, and package registries. Its Docker deployment is the most common installation method, praised for its simplicity: a single docker run command gets you a fully functional Git server.

That simplicity came with a hidden cost. The Gitea Docker image shipped with a dangerously permissive default configuration that left every instance running behind a reverse proxy wide open to impersonation attacks.

Vulnerability Details

CVE-2026-20896 affects Gitea Docker image versions up to and including 1.26.2. The root cause is straightforward:

The Docker image's default configuration template hard-codes:

REVERSE_PROXY_TRUSTED_PROXIES = *

This setting tells Gitea to trust authentication headers from any source IP address. While the documented default in app.example.ini only trusts loopback (127.0.0.0/8), the Docker build overrides this with a wildcard.

When an admin enables reverse-proxy authentication with:

ENABLE_REVERSE_PROXY_AUTHENTICATION = true

they expect only their authenticating reverse proxy to be able to inject identity headers. Instead, any client that can reach the container can impersonate any user by sending:

X-WEBAUTH-USER: alice

or, more critically:

X-WEBAUTH-USER: admin

CVSS Score: 9.8 (Critical)

Metric	Value
Attack Vector	Network
Attack Complexity	Low
Privileges Required	None
User Interaction	None
Scope	Unchanged
Confidentiality Impact	High
Integrity Impact	High
Availability Impact	High

The CISA assessment notes that PoC code is already available, the exploit is automatable, and the technical impact is total.

Who Discovered It

The vulnerability was responsibly disclosed by Joshua Martinelle of Tenable's bug bounty program. The Gitea team addressed it in releases 1.26.3 and 1.26.4, with 1.26.4 strongly recommended as it also fixes a regression in 1.26.3.

Impact Assessment

An unauthenticated attacker who exploits CVE-2026-20896 gains:

• Full repository access -- read, write, and delete any public or private repository
• Account impersonation -- perform any action as any user, including admins
• Secret exfiltration -- steal SSH keys, access tokens, CI/CD secrets, and environment variables stored in the Gitea instance
• Supply chain risk -- inject malicious code into repositories that downstream projects depend on
• Lateral movement -- use compromised access tokens to pivot to connected services (CI runners, registry integrations, webhooks)

This is not a theoretical risk. Threat actors began probing Gitea instances approximately 13 days after the initial disclosure, scanning for vulnerable Docker deployments. Active exploitation has been confirmed by multiple security vendors.

Affected Systems

Any Gitea instance running in Docker with version 1.26.2 or earlier is vulnerable if:

1. It uses the Docker image (binary/self-built deployments following documentation are NOT affected -- they get the safe loopback-only default)
2. Reverse-proxy authentication is enabled (ENABLE_REVERSE_PROXY_AUTHENTICATION = true)
3. The REVERSE_PROXY_TRUSTED_PROXIES setting was left at its Docker default

The vulnerability does NOT require reverse-proxy authentication to be enabled to be risky -- if an admin ever enables it in the future, the wildcard trust is already in place.

Mitigation and Patching

Immediate Action: Upgrade to Gitea 1.26.4

The safest and fastest mitigation is upgrading to Gitea 1.26.4, which changes the default to the documented loopback-only trust and makes reverse-proxy authentication fully opt-in.

Verify Your Exposure

Check if your instance is exploitable:

If this returns admin-level access or a user session, you are vulnerable.

If You Cannot Upgrade Immediately

As a temporary workaround, explicitly set REVERSE_PROXY_TRUSTED_PROXIES in your app.ini to only trust your reverse proxy's IP:

Or, if you use a specific proxy, set its CIDR range:

Detection

To determine if your instance has been compromised:

1. Check access logs for requests containing X-WEBAUTH-USER or X-Forwarded-User headers from unexpected source IPs
2. Audit user activity for suspicious logins or administrative actions from unfamiliar IPs
3. Review repository access logs for unusual clone or push activity
4. Check for unknown SSH keys or deploy tokens that may have been added by an attacker

Frequently Asked Questions

Q: Am I vulnerable if I don't use reverse-proxy authentication? A: No -- the exploit requires ENABLE_REVERSE_PROXY_AUTHENTICATION = true. However, if the setting was ever enabled in the past and later disabled, the wildcard trust may persist in your configuration.

Q: Does this affect Gitea binaries or source builds? A: No. Only the Docker image ships the permissive default. Binary installations and self-built deployments follow the documented safe default.

Q: Can I detect if someone has exploited this vulnerability against me? A: Check your reverse proxy and Gitea access logs for unexpected X-WEBAUTH-USER headers. Any request with this header from an untrusted source is suspicious.

Q: Is the Forgejo fork affected? A: Forgejo maintains its own Docker configuration. Check the Forgejo security advisories for its specific status.

Q: What if I use Gitea behind Cloudflare or another CDN? A: Cloudflare's authenticated origin pull and WAF can help block unauthorized header injection, but upgrading remains the definitive fix.

Key Takeaways

• CVE-2026-20896 is a critical (CVSS 9.8) auth bypass in Gitea Docker images
• A single X-WEBAUTH-USER header lets attackers impersonate any user
• Active exploitation has been confirmed by multiple security researchers
• Upgrade to Gitea 1.26.4 immediately -- the Docker tag includes the fix
• Binary/self-built deployments are not affected by the default configuration
• Audit your logs for signs of compromise if you suspect prior exposure

Conclusion

CVE-2026-20896 is a stark reminder that convenience defaults can become critical security liabilities. The Gitea team's rapid response -- shipping 1.26.3 and 1.26.4 with comprehensive fixes -- is commendable, but the responsibility to patch falls on every self-hoster. If you run Gitea in Docker, verify your version and upgrade today. Your repositories and their secrets depend on it.

---

Sources: Gitea Release Blog | NVD Entry | GitHub Security Advisory GHSA-f75j-4cw6-rmx4