Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure
Sysdig reports that threat actors have been seen trying to take advantage of a recently fixed serious security vulnerability in Gitea Docker images.
The vulnerability in question, CVE-2026-20896 (CVSS score: 9.8), is caused by the DevOps platform's reliance on the "X-WEBAUTH-USER" header from any originating IP address, hence granting elevated access to an unauthenticated internet client.
Security researcher Ali Mustafa (@rz1027), who is credited with finding and disclosing the vulnerability, claimed in an email to The Hacker News that the Gitea Docker images came with a "app.ini" template that hard-codes "REVERSE_PROXY_TRUSTED_PROXIES = *" by default. A key configuration file for controlling server parameters, database connections, security behavior, and application settings is the...