Loading vulnerability…
CVE-2026-20896 is a critical authentication bypass vulnerability affecting official Gitea Docker image deployments up to and including version 1.26.2. The issue is caused by the Docker image default configuration setting REVERSE_PROXY_TRUSTED_PROXIES to a wildcard value, which causes Gitea to trust reverse-proxy authentication headers from any source IP address instead of only from explicitly trusted proxies. When reverse-proxy authentication is enabled, an unauthenticated remote attacker can supply a forged identity header such as X-WEBAUTH-USER and be authenticated as an arbitrary user, including an administrator, without a password or token. The flaw is specific to the packaged Docker image configuration rather than the core reverse-proxy authentication design, and standard or self-built installations using the documented loopback-only trusted-proxy defaults are not affected.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (2 hidden).
Repository contains a small standalone Python PoC and companion detector for CVE-2026-20896 affecting Gitea reverse-proxy authentication trust handling. Structure is minimal: README with usage and context, detect.py for safe vulnerability checking, poc.py for exploitation, and docker-compose.yml for a reproducible local vulnerable lab using gitea/gitea:1.26.2 on port 3000. The main exploit is poc.py: it sends an HTTP request to the normal web page /user/settings with a spoofed X-WEBAUTH-USER header, relies on the target accepting that header as trusted reverse-proxy identity, captures any issued session cookies, and writes them to browser-importable TXT and JSON files. This enables arbitrary user impersonation and browser session reuse rather than command execution. detect.py is not the exploit itself; it is a checker that compares baseline and spoofed requests to /user/settings and reports likely vulnerability conditions. The docker-compose file intentionally enables reverse-proxy authentication while leaving trusted proxies at the vulnerable default/wildcard behavior described in the comments, making the lab exploitable. Overall, this is a real operational web-session impersonation PoC for Gitea, not just a README or pure detector.
Repository contains a small standalone Python proof-of-concept and a companion detection script for CVE-2026-20896 affecting Gitea official Docker images up to 1.26.2. The vulnerability is not a memory corruption bug but a web authentication trust failure caused by the Docker image default REVERSE_PROXY_TRUSTED_PROXIES = * combined with enabled reverse-proxy authentication. The PoC in poc.py sends normal HTTP requests to a protected page (/user/settings) and repeats the request with a spoofed X-WEBAUTH-USER header. If the target trusts the header from any source IP, Gitea creates or authenticates the named user and returns the protected page, demonstrating arbitrary user impersonation and potential admin takeover. The exploit is operational but simple: no shell payload, just authenticated session hijacking through header spoofing. detect.py is a safer checker that compares baseline and spoofed responses to determine likely vulnerability without intentionally impersonating a real user. docker-compose.yml provides a reproducible vulnerable lab using gitea/gitea:1.26.2 on port 3000 with reverse-proxy authentication and auto-registration enabled, intentionally inheriting the insecure wildcard trusted-proxy default. Overall structure: README with vulnerability explanation and usage, poc.py for exploitation, detect.py for detection, and docker-compose.yml for local reproduction.
114 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An authentication bypass vulnerability in Gitea related to reverse proxy authentication trust configuration, where supplying the X-WEBAUTH-USER header can result in unauthorized login when trusted proxies are overly permissive.
A critical authentication bypass in Gitea official Docker images caused by an unsafe default reverse proxy trust configuration that allows unauthenticated attackers to forge headers and impersonate arbitrary users, including administrators.
A critical authentication bypass vulnerability in the official Gitea Docker image default configuration that lets unauthenticated attackers impersonate arbitrary users, including administrators, by supplying trusted reverse-proxy authentication headers from any source IP.
A critical authentication bypass vulnerability in official Gitea Docker images caused by insecure default reverse-proxy trust settings that allow attackers to send a crafted X-WEBAUTH-USER header and impersonate arbitrary users, including administrators.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.