CRITICAL flaws in the Gitea self‑hosted Git service have been exploited to take over servers, as reported by SecurityWeek. The vulnerabilities tracked as CVE-2026-20896 and CVE-2026-22874 affect Docker images earlier than version 1.26.3 and allow remote unauthenticated attackers to gain administrative access.
The first issue, CVE-2026-20896, carries a CVSS score of 9.8 and stems from a misconfigured reverse-proxy authentication mechanism. By inserting a valid username into an HTTP request header, an attacker can bypass authentication entirely because the service defaults to accepting connections from any IP address instead of using an allowlist.
The second flaw, CVE-2026-22874, is rated CVSS 9.6 and results from an incomplete Server-Side Request Forgery allowlist. This permits an attacker to craft requests that reach internal services, potentially leading to the hijacking of administrator accounts and access to sensitive cloud metadata.
Researchers observed exploitation of CVE-2026-20896 within days of its public disclosure, with threat actors probing the Docker flaw shortly after announcement. Around 6,200 Gitea instances were found exposed to the internet, although no specific threat actor has been linked to the activity so far.
The bugs pose a clear risk to DevOps pipelines, as compromise of a Gitea server can expose source code, build credentials and integration tokens. The rapid appearance of active attacks underlines the need for organisations to treat newly disclosed vulnerabilities as immediate priorities.
Defenders should upgrade all Gitea installations to version 1.26.3 or later, which patches both CVE-2026-20896 and CVE-2026-22874. In addition, administrators must restrict reverse-proxy access to trusted IP ranges, enforce strict validation of authentication headers, review and tighten any SSRF allowlist, and monitor logs for abnormal header usage or unexpected outbound requests.