Loading story…
Gitea disclosed two severe vulnerabilities affecting repository automation and artifact handling. CVE-2026-58424 is a remotely exploitable authorization flaw with a CVSS score of 8.9 that can bypass permanent fork pull-request workflow approval gates, undermining branch protection and merge controls. The issue is tied to permission weaknesses including CWE-285, CWE-732, and CWE-863, and fixes are referenced in Gitea releases 1.26.3 and 1.26.4. Administrators are advised to harden pull-request workflow approvals, enforce strict branch protections, and review workflow logs for signs of bypass attempts.
Gitea also addressed CVE-2026-58426, a critical signed-URL validation flaw in Gitea Actions Artifacts V4 with a CVSS score of 9.6. The CWE-347 weakness stems from HMAC ambiguity and can allow cross-repository artifact reads and cross-task upload-state writes, creating a path for unauthorized access to build artifacts and tampering with task state. The recommended response is to upgrade to a fixed Gitea release, cited as 1.26.2, and audit artifact access controls and upload-state integrity. Separately, Canada’s Centre for Cyber Security issued an advisory urging OpenSSH users to upgrade versions prior to 10.4, but that notice appears unrelated to the Gitea flaws.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
OpenSSH published a security advisory addressing vulnerabilities in versions prior to 10.4. The Canadian Centre for Cyber Security notice urges users and administrators to review the release notes and upgrade to version 10.4 or later.
Two Gitea vulnerabilities were published: CVE-2026-58424, a workflow approval gate bypass, and CVE-2026-58426, an HMAC ambiguity flaw affecting Actions artifact signed URLs. The references indicate fixes are tied to Gitea release information, including versions 1.26.2, 1.26.3, and 1.26.4.
Gitea announced the release of versions 1.26.3 and 1.26.4 in a blog post. These releases are later referenced as containing fixes related to CVE-2026-58424 and CVE-2026-58426.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
cyber.gc.ca
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceblog.gitea.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
German authorities issued multiple security advisories for **GitLab** and **Gitea**, warning of newly tracked vulnerabilities that affect widely used source code management and DevOps platforms. Two separate dCERT notices flagged **multiple vulnerabilities in GitLab**, indicating more than one security issue requiring administrator attention across the platform. A separate dCERT advisory warned that **Gitea** contains a vulnerability that can **bypass security measures**, raising concern that protections intended to restrict access or enforce policy may be circumvented. While the advisories did not publish technical synopses in the referenced notices, the alerts indicate that organizations using GitLab or Gitea should review vendor guidance, identify affected deployments, and prioritize patching or other mitigations.
Jun 29, 2026
A critical flaw in **Gitea `act_runner`** and a separate compromise of popular **GitHub Actions** highlighted how CI/CD platforms can be turned into high-impact attack paths. In Gitea, **`CVE-2026-58053`** allows a user with workflow execution privileges to escape a Docker-backed job container and gain **root access on the host** by abusing unsafe Docker options merged from `container.options`, including `--pid=host`, `--cap-add`, and `--security-opt`. The issue affects Docker-backed `act_runner` deployments through version `0.262.0`, putting source code, build systems, and deployment credentials at risk. In the GitHub ecosystem, attackers compromised tags for **`tj-actions/changed-files`** and several **reviewdog** actions in a supply-chain campaign tracked as **`CVE-2025-30066`** and **`CVE-2025-30154`**, causing CI/CD secrets to be written into workflow logs and potentially exposed, especially in public repositories. Reporting tied the activity to an intrusion that likely began with Coinbase-related targets before expanding more broadly. Defenders were urged to upgrade vulnerable Gitea runners, restrict workflow container options, audit workflows and logs, remove affected actions, rotate exposed secrets, preserve and then delete compromised logs, and pin GitHub Actions to full commit hashes.
Jul 7, 2026
Threat actors have begun probing a critical authentication bypass in official Gitea Docker images, tracked as **CVE-2026-20896**, shortly after public disclosure and patch release. The flaw stems from a default configuration that sets `REVERSE_PROXY_TRUSTED_PROXIES = *`, causing Gitea to trust the `X-WEBAUTH-USER` header from any source IP when reverse-proxy authentication is enabled. An attacker that can directly reach the Gitea HTTP service can impersonate any existing user without a password or session cookie, including administrators, and may also create accounts if auto-registration is enabled. The issue affects Gitea Docker image deployments through **1.26.2** and was fixed in **1.26.3** and later by removing wildcard proxy trust and making reverse-proxy authentication opt-in. Researchers reported the first observed in-the-wild activity 13 days after disclosure, with reconnaissance tied to ProtonVPN-associated infrastructure, while public proof-of-concept details have increased the risk of broader exploitation. With roughly **6,200** internet-facing Gitea instances estimated to be exposed, organizations are being urged to upgrade immediately and review systems for unauthorized access.
Jul 8, 2026