// NEXUSVOID CYBER NEWS
<- ALL CYBER NEWS
Critical
Gitea, CVE-2026-20896, authentication bypass, source code, secrets, supply chain, active exploitation
One HTTP Header Is Enough to Walk Into Self-Hosted Git Repositories
A critical Gitea flaw, CVE-2026-20896, lets attackers bypass authentication with a single crafted header and reach private repositories and their secrets. It is already under active exploitation, and source code plus secrets is exactly what an attacker wants.
A critical vulnerability in Gitea, the popular self-hosted alternative to GitHub, is being exploited in the wild, researchers have warned. Tracked as CVE-2026-20896 and carrying a CVSS score of 9.8, the flaw lets an attacker bypass authentication with a single HTTP header and reach repositories and the secrets stored alongside them, as reported by SecurityWeek.
The exposure here is worse than it first sounds. A Git server does not just hold code, it holds the credentials, tokens, and deployment keys that teams leave in their repositories, and read access to those is often read access to everything they unlock. This is the raw material of a software supply chain attack.
The timing follows a familiar and uncomfortable pattern. According to reporting on findings from Sysdig, threat actors began probing the flaw in Gitea's Docker images around thirteen days after disclosure, a reminder that the quiet gap after a patch ships is not safe time, it is a countdown, per The Hacker News.
Organizations running Gitea should update immediately, rotate any secrets that lived in reachable repositories, and comb access logs for unexpected reads. When the system that stores your source code can be opened with one header, the only safe assumption is that someone has already tried the door.
Sources: SecurityWeek, The Hacker News.