Back mondoo.com

Mondoo Vulnerability Intelligence

mondoo.com • July 8, 2026

Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Gitea Docker Authentication Bypass Vulnerability Under Active Exploitation CVE-2026-20896 is a critical authentication bypass vulnerability (CVSS 9.8) affecting Gitea Docker images up to version 1.26.2. Discovered on July 3, 2026, the flaw allows unauthenticated remote attackers to impersonate any user by injecting a crafted X-WEBAUTH-USER HTTP header. Thirteen days post-disclosure, attackers began probing for vulnerable instances, with initial reconnaissance linked to a ProtonVPN exit node. The vulnerability arises from a misconfiguration in the Docker image, which trusts all reverse proxies, disabling critical source validation. Exploitation is straightforward, enabling attackers to gain full access to repositories and sensitive data. The issue is exacerbated by the prevalence of default configurations in Docker deployments. As of now, there is no evidence connecting the exploitation to specific APT groups or organized crime syndicates. 8 sources 73

Extracted Entities

Mondoo Vulnerability Intelligence

The full story

Extracted Entities

CWE Weaknesses (1)

Platforms (1)

Tools (1)