www.noscope.com Gitea Vulnerability Exposes 30,000 Private Container Images to Attackers
Article Content
- •CVE-2026-27771 allows unauthenticated access to private container images on Gitea instances.
- •Over 30,000 deployments across 30 countries are affected by this vulnerability.
- •Organizations are advised to upgrade to Gitea v1.26.2 to mitigate the risk.
A critical vulnerability, CVE-2026-27771, in Gitea's container registry allowed unauthenticated users to access private container images for nearly four years. Discovered by Noscope in April 2026, the flaw affects over 30,000 deployments globally, including instances of Forgejo. The vulnerability stems from a logic error in access control, allowing attackers to pull private images without credentials. Organizations using Gitea are urged to upgrade to version 1.26.2, released on May 20, 2026, which addresses the issue but does not fully resolve underlying architectural problems. The flaw's ease of exploitation raises concerns about potential data exfiltration and credential compromise. As of now, there are no confirmed reports of active exploitation in the wild.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (8)
Following this threat?
Track Forgejo and CVE-2026-27771 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include… 
Critical Zero-Day Exploit Found in BeyondTrust Remote Support BeyondTrust disclosed a critical vulnerability, CVE-2026-102764, in its Remote Support product, exploited by the suspected China-linked group ARMORY CASTLE since August 2026. This flaw, with a CVSS score of 9.3, allows attackers to perform arbitrary file uploads and gain host-level control without requiring…