Loading story…
Threat actors have begun probing a critical authentication bypass in official Gitea Docker images, tracked as CVE-2026-20896, shortly after public disclosure and patch release. The flaw stems from a default configuration that sets REVERSE_PROXY_TRUSTED_PROXIES = *, causing Gitea to trust the X-WEBAUTH-USER header from any source IP when reverse-proxy authentication is enabled. An attacker that can directly reach the Gitea HTTP service can impersonate any existing user without a password or session cookie, including administrators, and may also create accounts if auto-registration is enabled.
The issue affects Gitea Docker image deployments through 1.26.2 and was fixed in 1.26.3 and later by removing wildcard proxy trust and making reverse-proxy authentication opt-in. Researchers reported the first observed in-the-wild activity 13 days after disclosure, with reconnaissance tied to ProtonVPN-associated infrastructure, while public proof-of-concept details have increased the risk of broader exploitation. With roughly 6,200 internet-facing Gitea instances estimated to be exposed, organizations are being urged to upgrade immediately and review systems for unauthorized access.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Sysdig reported the first in-the-wild exploitation attempt against CVE-2026-20896 13 days after public disclosure. The observed activity appeared limited to initial reconnaissance from a ProtonVPN-associated IP address.
Gitea fixed CVE-2026-20896 by removing wildcard trusted proxies and making reverse-proxy authentication opt-in in updated Docker image releases. The flaw affected official Docker image deployments through version 1.26.2.
Lupovis observed coordinated scanning and exploitation activity targeting CVE-2026-8451 within 24 hours of its disclosure and proof-of-concept release. Researchers warned the flaw could support initial access, privilege escalation, lateral movement, and data exfiltration.
Citrix publicly disclosed and patched CVE-2026-8451, a NetScaler memory overread vulnerability affecting ADC and Gateway devices configured as a SAML identity provider. On the same day, WatchTowr published technical details and a proof of concept for the flaw.
Gitea disclosed CVE-2026-20896, an authentication bypass in official Docker images caused by trusting the X-WEBAUTH-USER header from any source IP when reverse-proxy authentication is enabled. The advisory identified verified affected versions including Docker image 1.26.2 and warned that attackers could impersonate arbitrary users, including administrators.
A remote code execution vulnerability in crawl4ai's Docker API server was fixed in version 0.9.0 by forbidding dangerous request-supplied Chromium launch arguments in untrusted request bodies. The issue affected the /crawl, /crawl/stream, and /crawl/job endpoints and was especially severe because the Docker API was unauthenticated by default.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcesecurityweek.com
Open sourcethreataft.com
Open sourcethehackernews.com
Open sourcedarkreading.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Gitea disclosed two severe vulnerabilities affecting repository automation and artifact handling. **CVE-2026-58424** is a remotely exploitable authorization flaw with a CVSS score of **8.9** that can bypass permanent fork pull-request workflow approval gates, undermining branch protection and merge controls. The issue is tied to permission weaknesses including `CWE-285`, `CWE-732`, and `CWE-863`, and fixes are referenced in Gitea releases **1.26.3** and **1.26.4**. Administrators are advised to harden pull-request workflow approvals, enforce strict branch protections, and review workflow logs for signs of bypass attempts. Gitea also addressed **CVE-2026-58426**, a critical signed-URL validation flaw in **Gitea Actions Artifacts V4** with a CVSS score of **9.6**. The `CWE-347` weakness stems from HMAC ambiguity and can allow cross-repository artifact reads and cross-task upload-state writes, creating a path for unauthorized access to build artifacts and tampering with task state. The recommended response is to upgrade to a fixed Gitea release, cited as **1.26.2**, and audit artifact access controls and upload-state integrity. Separately, Canada’s Centre for Cyber Security issued an advisory urging OpenSSH users to upgrade versions prior to **10.4**, but that notice appears unrelated to the Gitea flaws.
Jul 7, 2026
German authorities issued multiple security advisories for **GitLab** and **Gitea**, warning of newly tracked vulnerabilities that affect widely used source code management and DevOps platforms. Two separate dCERT notices flagged **multiple vulnerabilities in GitLab**, indicating more than one security issue requiring administrator attention across the platform. A separate dCERT advisory warned that **Gitea** contains a vulnerability that can **bypass security measures**, raising concern that protections intended to restrict access or enforce policy may be circumvented. While the advisories did not publish technical synopses in the referenced notices, the alerts indicate that organizations using GitLab or Gitea should review vendor guidance, identify affected deployments, and prioritize patching or other mitigations.
Jun 29, 2026
A critical flaw in **Gitea `act_runner`** and a separate compromise of popular **GitHub Actions** highlighted how CI/CD platforms can be turned into high-impact attack paths. In Gitea, **`CVE-2026-58053`** allows a user with workflow execution privileges to escape a Docker-backed job container and gain **root access on the host** by abusing unsafe Docker options merged from `container.options`, including `--pid=host`, `--cap-add`, and `--security-opt`. The issue affects Docker-backed `act_runner` deployments through version `0.262.0`, putting source code, build systems, and deployment credentials at risk. In the GitHub ecosystem, attackers compromised tags for **`tj-actions/changed-files`** and several **reviewdog** actions in a supply-chain campaign tracked as **`CVE-2025-30066`** and **`CVE-2025-30154`**, causing CI/CD secrets to be written into workflow logs and potentially exposed, especially in public repositories. Reporting tied the activity to an intrusion that likely began with Coinbase-related targets before expanding more broadly. Defenders were urged to upgrade vulnerable Gitea runners, restrict workflow container options, audit workflows and logs, remove affected actions, rotate exposed secrets, preserve and then delete compromised logs, and pin GitHub Actions to full commit hashes.
Jul 7, 2026