CVE-2026-208969.8CriticalCWE-284
CVE-2026-20896: Gitea Open Source Git Server vulnerability
Gitea · Gitea Open Source Git Server
Vendor fix available · Affected: Gitea Open Source Git Server · Exploitation: public proof of concept (unverified)
ExploitationProof of concept public
Not in CISA KEV as of catalogue 2026.11.13 (13 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public8 public GitHub repositories (unverified), listed by PoC-in-GitHub2 Jul
- Not established: not seen
2.8%probability of exploitation in the next 30 days
86th percentile
050100
Higher than 86% of scored CVEs
9.8CriticalCVSS 3.1
LowMediumHighCrit.
DescriptionNVD
Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled.
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Check available, not yet exploited. A public nuclei template can confirm it on a system you are authorised to test.
- CISA KEV
- Not listed
- Public check
- Gitea Docker Image <= 1.26.2 - Reverse Proxy Header Authentication Bypass · nuclei template in projectdiscovery/nuclei-templates
- Vendor
- Gitea
- Published
- July 2026
What changed
- PoC-in-GitHub lists 8 public GitHub repositories (unverified) PoC-in-GitHub
Coverage5 articles · 4 outlets
One row per outlet, in order of first report. First in our coverage: SecurityOnline, 25 Jun.
Quiet for 12 weekslast report 26 Aug5 articles4 outlets
- Thu 25 Jun, 02:21 UTC. SecurityOnline, first report. Gitea auth flaw lets attackers hijack admin accounts via SSRF.
- Mon 6 Jul, 17:41 UTC. The Hacker News, its first report on the story. Attackers Exploit New Gitea Docker Bug CVE-2026-20896.
- Tue 7 Jul, 17:31 UTC. SecurityWeek, its first report on the story. Critical Gitea Flaw Under Active Exploitation, Researchers Warn.
- Tue 7 Jul, 22:31 UTC. Security Affairs, its first report on the story. CVE-2026-20896: Gitea Docker flaw lets attackers bypass auth.
- Wed 26 Aug, 05:50 UTC. SecurityWeek. CISA Warns of Exploited Gitea Flaw CVE-2026-60004 Patch by Aug 28.
- First report
- Article
- Running total
Show as tableHide table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| 25 Jun 02:21 | SecurityOnline | Gitea auth flaw lets attackers hijack admin accounts via SSRF |
| 6 Jul 17:41 | The Hacker News | Attackers Exploit New Gitea Docker Bug CVE-2026-20896 |
| 7 Jul 17:31 | SecurityWeek | Critical Gitea Flaw Under Active Exploitation, Researchers Warn |
| 7 Jul 22:31 | Security Affairs | CVE-2026-20896: Gitea Docker flaw lets attackers bypass auth |
| 26 Aug 05:50 | SecurityWeek | CISA Warns of Exploited Gitea Flaw CVE-2026-60004 Patch by Aug 28 |
- CISA Warns of Exploited Gitea Flaw CVE-2026-60004 Patch by Aug 28SecurityWeek · mentions it in passing
- CVE-2026-20896: Gitea Docker flaw lets attackers bypass authSecurity Affairs
- Attackers Exploit New Gitea Docker Bug CVE-2026-20896The Hacker News
- Gitea auth flaw lets attackers hijack admin accounts via SSRFSecurityOnline · first in our coverage
New articles also arrive in the RSS feed.