Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure

Threat actors have been observed attempting to exploit a recently patched critical security flaw in Gitea Docker images, according to Sysdig. The vulnerability in question is CVE-2026-20896 CVSS score: 9.8, a vulnerability that stems from the DevOps platform trusting the "X-WEBAUTH-USER" header...

CVE-2026-20896

Gitea Docker images up to 1.26.2 ship REVERSE_PROXY_TRUSTED_PROXIES = *, which allows any source IP to spoof and impersonate a user via X-WEBAUTH-USER when reverse-proxy authentication is enabled. This affects gitea/gitea:1.26.2 and related Docker templates, enabling unauthenticated impersonation...