Threat actors are exploiting a vulnerability in Gitea's reverse-proxy authentication mechanism, tracked as CVE-2026-20896, to access internet-accessible instances by supplying only a valid username. This vulnerability is specific to Gitea's official Docker images and allows authentication bypass with a single HTTP header.

The security defect has a CVSS score of 9.8. Ali Mustafa, a security researcher credited for finding the bug, stated, "The issue exists because, in Gitea Docker images before 1.26.3, the default settings allow connections from any source IP address instead of enforcing an allowlist."

Mustafa added, "Any process that can reach the Gitea container's HTTP port directly — not through the intended authenticating proxy — can impersonate any user whose login name is known or guessable." He also noted, "Admin accounts are the obvious targets."

Exploitation of CVE-2026-20896 began 13 days after its public disclosure. Michael Clark, Senior Director of Threat Research at Sysdig, said, "Sysdig sensors caught the first in-the-wild hit 13 days after the advisory." Clark described the exploit: "No password. No token. One header." The attempt was linked to a VPN-exit scanner that gained access.

Sysdig's research identified approximately 6,200 Gitea instances accessible from the internet. It remains unclear how many of these instances are vulnerable. Clark detailed the potential impact of compromised accounts: "A Gitea user can read and write their repositories, private ones included: the code they ship, the secrets developers committed by accident (API keys, DB credentials, deploy tokens), their CI/CD config, and deploy keys."

The patch introduced in Gitea versions 1.26.3 and 1.26.4 makes reverse-proxy authentication an opt-in feature.