Skip to main content
Meet us at Black Hat USA 2026— Las Vegas, August 1–6Book a Meeting
Mallory
Back to vulnerabilities
Unrated

Authentication Bypass in Gitea Docker Reverse Proxy Authentication

IdentifiersCVE-2026-20896CWE-306

CVE-2026-20896 is a critical authentication bypass affecting official Gitea Docker images through version 1.26.2. In affected Docker deployments, the default configuration template sets REVERSE_PROXY_TRUSTED_PROXIES = *, causing Gitea to trust reverse-proxy authentication headers from any source IP rather than only from explicitly trusted proxies. When ENABLE_REVERSE_PROXY_AUTHENTICATION is enabled, Gitea accepts the X-WEBAUTH-USER header for user identity. Because all client IPs are effectively trusted under the vulnerable Docker default, a remote attacker can send a crafted X-WEBAUTH-USER header directly to the Gitea instance and be authenticated as any arbitrary user, including an administrator. The issue is described as affecting Docker-based deployments; source-built Gitea instances using the standard sample configuration are stated to be unaffected.

Share:
For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial
ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows full authentication bypass and user impersonation. An attacker can log in as any existing user, including administrators, and then perform actions available to that account. Reported consequences include administrator account takeover, modification of SSH keys, disabling of 2FA, export or access to private repositories, and redirection or manipulation of webhook URLs. If reverse proxy auto-registration is enabled, the attacker may also be able to create arbitrary accounts through the same mechanism.

Mitigation

If you can’t patch tonight, do this now.

If immediate upgrade is not possible, disable ENABLE_REVERSE_PROXY_AUTHENTICATION unless it is strictly required. Replace any wildcard or overly broad REVERSE_PROXY_TRUSTED_PROXIES setting with only the specific reverse proxy addresses that should be trusted, consistent with the documented secure default model. Ensure Gitea is not directly reachable by untrusted clients when reverse proxy authentication is in use, and place it behind a properly configured proxy that strips or overwrites authentication headers from external requests. Also disable ENABLE_REVERSE_PROXY_AUTO_REGISTRATION unless explicitly needed.

Remediation

Patch, then assume compromise.

Upgrade Gitea to version 1.26.3 or later. The fix reportedly makes reverse proxy authentication opt-in and removes the wildcard trusted proxy default from official Docker images. After upgrading, verify that reverse proxy authentication is only enabled where required and that trusted proxy settings are explicitly restricted to the actual upstream proxy IP addresses or ranges.
PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

ACTIVITY FEED

Recent activity

7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

7 SOURCESView more in app
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.
Start free trial
Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity5

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES
MITRE CVE
cve.org · CVE-2026-20896
NVD
nvd.nist.gov/vuln/detail/CVE-2026-20896
MITRE CWE · CWE-306
cwe.mitre.org