CVE-2026-20896 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-20896 requires immediate attention.

· 7 min read

Executive Summary

CVE-2026-20896 is a critical authentication bypass in Gitea Docker image versions up to and including 1.26.2. The default setting REVERSE_PROXY_TRUSTED_PROXIES=* can let any source IP be treated as trusted when reverse-proxy authentication headers are enabled, such as X-WEBAUTH-USER. In practice, that means an attacker may impersonate another user and gain unauthorized access to your Gitea instance.

This is especially dangerous for solo developers and small teams because many deployments rely on simple reverse-proxy setups, shared admin accounts, or internet-exposed self-hosted services. Even though this issue is not currently known to be exploited in the wild and is not in CISA KEV, the severity is CRITICAL (CVSS 9.8) and should be treated as an urgent patch-and-hardening event.

Immediate Action

  • Upgrade Gitea immediately to a fixed release as soon as one is available. If you do not yet have a confirmed fixed tag, use the latest vendor advisory and release notes: Gitea security advisory / release notes.
  • Disable reverse-proxy auth headers such as X-WEBAUTH-USER until you have verified trusted proxy settings are locked down.
  • Remove wildcard trusted proxies and replace REVERSE_PROXY_TRUSTED_PROXIES=* with explicit proxy IPs or CIDRs only.
  • Restrict network exposure: temporarily place Gitea behind VPN, firewall allowlist, or private network access if you cannot patch immediately.
  • Rotate credentials and review logs for unexpected logins, account changes, or repo access from unusual IPs.
  • Rollback guidance: if an upgrade breaks your setup, roll back only to a known-safe version with strict proxy trust settings; do not roll back to a vulnerable image with the wildcard default still in place.

Affected Versions

  • gitea/gitea:1.26.2 and all earlier Docker image versions are vulnerable.
  • gitea/gitea:<=1.26.2 vulnerable; upgrade to TODO_FIXED_VERSION or later.
  • REVERSE_PROXY_TRUSTED_PROXIES=* is unsafe in any deployment that accepts reverse-proxy authentication headers.
  • Safe versions: gitea/gitea:TODO_FIXED_VERSION+ with explicit trusted proxy configuration and reverse-proxy auth reviewed.

Resolution Guide

Docker / Docker Compose

# Pull the patched image once you know the fixed tag
docker pull gitea/gitea:TODO_FIXED_VERSION

# Example compose hardening
services:
  gitea:
    image: gitea/gitea:TODO_FIXED_VERSION
    environment:
      - REVERSE_PROXY_TRUSTED_PROXIES=10.0.0.0/8,192.168.0.0/16
      - DISABLE_REGISTRATION=true
      - REQUIRE_SIGNIN_VIEW=true

Immediate hardening if you cannot upgrade yet

# Replace wildcard trust with explicit proxy IPs/CIDRs
export REVERSE_PROXY_TRUSTED_PROXIES="192.0.2.10,198.51.100.0/24"

# If possible, disable reverse-proxy auth headers at the proxy layer
# Example for Nginx: remove or do not set X-WEBAUTH-USER

JavaScript / Python / Java package ecosystems

This issue is primarily a container image/configuration problem, not a typical library dependency. If you wrap Gitea in deployment tooling, update the image tag rather than a package manager dependency.

# npm / yarn / pnpm: not applicable to the Gitea server image itself
# Use your deployment manifest to pin the Docker tag instead.

# pip / pipx: not applicable
# Maven / Gradle: not applicable

# apt / yum: not applicable unless you installed a distro package for Gitea
# Prefer the vendor-provided fixed container image or distro package update.

Linux package managers

# If your distro ships Gitea as a package, update from your repo
sudo apt update && sudo apt install --only-upgrade gitea

sudo yum update gitea
sudo dnf update gitea

Config hardening example

[server]
REVERSE_PROXY_TRUSTED_PROXIES = 10.0.0.0/8,192.168.0.0/16
ENABLE_REVERSE_PROXY_AUTHENTICATION = false

Minimal code fix example if you maintain a fork or wrapper:

// Pseudocode: reject wildcard trust for reverse-proxy auth
if (config.ReverseProxyTrustedProxies == "*") {
    return error("wildcard trusted proxies are not allowed");
}

Detection & Verification

Check your running version

docker inspect gitea --format '{{.Config.Image}}'
docker exec -it gitea gitea --version

Search for risky config

grep -RIn "REVERSE_PROXY_TRUSTED_PROXIES\|X-WEBAUTH-USER\|reverse proxy" /etc/gitea /data/gitea 2>/dev/null

Verify the fix

# Confirm the wildcard is gone
docker exec -it gitea sh -lc 'env | grep REVERSE_PROXY_TRUSTED_PROXIES'

# Confirm the proxy only forwards auth headers from trusted IPs
curl -I https://your-gitea.example.com

Dependency / image audit

docker images | grep gitea
docker compose config | grep gitea

What good looks like: the image tag is a fixed release, the trusted proxy list contains only explicit IPs/CIDRs, and reverse-proxy auth headers are not accepted from the public internet.

Risk and Impact

An attacker who can reach your Gitea service may be able to impersonate arbitrary users, including admins, if reverse-proxy authentication is enabled and the wildcard trusted-proxy default is still in place. That can lead to source code theft, malicious commits, credential exposure, repository deletion, or account takeover.

For small teams, the blast radius can be the entire codebase and all connected CI/CD secrets. If your Gitea instance is internet-facing, treat this as a high-priority incident response item even without evidence of active exploitation.

Keep reading