CVE-2026-20896
Gitea Docker image trusts spoofable reverse-proxy headers by default
CRITICAL 9.8EPSS 2.8%
Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled.
- Affected
- Gitea · Gitea Open Source Git Server
- CVSS v3.1 CNA
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- 2.76% chance of exploitation in the next 30 days, 86th percentile
- Nuclei
- critical · CWE-290
- Published
- 2026-07-03
- Updated
- 2026-07-07
Proof-of-concept exploits (8)
- advisories/GHSA-f75j-4cw6-rmx4
- kaleth4/CVE-2026-208961★ · 2026-07-03
- szybnev/cve-2026-20896-gitea-poc10★ · 2026-07-07
- XaocZenon/CVE-2026-208966★ · 2026-07-16
- EQSTLab/CVE-2026-208961★ · 2026-08-04
- judgedbykira/CVE-2026-20896-Gitea-Authentication-Bypass1★ · 2026-08-15
- rz1027/CVE-2026-208966★ · 2026-07-05
- yym8538/CVE-2026-208961★ · 2026-08-21