www.noscope.com Gitea Vulnerability Exposes 30,000 Private Container Images to Attackers
Article Content
- •CVE-2026-27771 allows unauthenticated access to private container images on Gitea instances.
- •Over 30,000 deployments across 30 countries are affected by this vulnerability.
- •Organizations are advised to upgrade to Gitea v1.26.2 to mitigate the risk.
A critical vulnerability, CVE-2026-27771, in Gitea's container registry allowed unauthenticated users to access private container images for nearly four years. Discovered by Noscope in April 2026, the flaw affects over 30,000 deployments globally, including instances of Forgejo. The vulnerability stems from a logic error in access control, allowing attackers to pull private images without credentials. Organizations using Gitea are urged to upgrade to version 1.26.2, released on May 20, 2026, which addresses the issue but does not fully resolve underlying architectural problems. The flaw's ease of exploitation raises concerns about potential data exfiltration and credential compromise. As of now, there are no confirmed reports of active exploitation in the wild.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (8)
Following this threat?
Track Forgejo and CVE-2026-27771 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active… 
CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…