Attackers Begin Scanning Gitea Docker Vulnerability CVE-2026-20896 Just 13 Days After Disclosure
Security firm Sysdig reports that malicious actors have started probing a high-severity flaw in official Gitea Docker images that was patched recently. The vulnerability, tracked as CVE-2026-20896 and rated 9.8 by CVSS, arises because the code accepts the “X-WEBAUTH-USER” HTTP header from any source IP, enabling unauthenticated clients to gain elevated access.
Ali Mustafa (@rz1027), the researcher credited with finding and reporting the issue, said that the official Docker images include an app.ini template which sets REVERSE_PROXY_TRUSTED_PROXIES = * by default. The app.ini file is Gitea’s central configuration document that controls server parameters, database connections, security policies and other application settings.
Mustafa explained that when reverse-proxy authentication is enabled, the wildcard entry causes the system to trust requests from any IP address. That means any client able to reach the container’s HTTP port can supply an X-WEBAUTH-USER header and be treated as an authenticated user without supplying a password or token. If auto-registration is enabled, registering a username with administrative privileges effectively grants admin rights.
By contrast, the recommended safe value for REVERSE_PROXY_TRUSTED_PROXIES is “127.0.0.0/8,::1/128”, which restricts trusted proxies to localhost (the loopback interface). The official Docker image, however, shipped with the “*” wildcard hard-coded, effectively rendering the allowlist meaningless.
As a result, enabling ENABLE_REVERSE_PROXY_AUTHENTICATION = true while leaving REVERSE_PROXY_TRUSTED_PROXIES at its default allows a custom X-WEBAUTH-USER header from any reachable IP to authenticate as any known or guessable username. Gitea’s advisory warns that any process that can contact the container’s HTTP port directly-rather than via the intended authenticating reverse proxy-can impersonate users, with administrative accounts such as “admin” or “gitea_admin” being obvious targets.
The issue impacts Gitea Docker images up to and including version 1.26.2 and was fixed in release 1.26.3, published late last month. The patch removes the “*” wildcard and changes reverse-proxy authentication to be opt-in.
Sysdig says it observed the first in-the-wild scanning activity 13 days after the vulnerability was publicly disclosed. There are roughly 6,200 Gitea instances exposed to the internet, making speedy patching important. Michael Clark, senior director of threat research at Sysdig, told that the observed activity so far appears to be reconnaissance rather than a fully developed exploit campaign.
Sysdig’s telemetry shows the initial probing originated from an IP tied to the ProtonVPN service, 159.26.98[.]241, but the company has not seen any follow-on exploitation or attack escalation. Clark suggested this is likely because defenders detected the activity early, before attackers could advance beyond initial discovery.
Given the severity and ease of exploitation, administrators running Gitea in Docker should upgrade to 1.26.3 or apply the mitigation immediately – ensure REVERSE_PROXY_TRUSTED_PROXIES is restricted to trusted proxy addresses (for example “127.0.0.0/8,::1/128”) and verify reverse-proxy authentication settings are configured intentionally.