A critical vulnerability in Gitea, the popular self-hosted alternative to GitHub, is being exploited in the wild, researchers have warned. Tracked as CVE-2026-20896 and carrying a CVSS score of 9.8, the flaw lets an attacker bypass authentication with a single HTTP header and reach repositories and the secrets stored alongside them, as reported by SecurityWeek.

The exposure here is worse than it first sounds. A Git server does not just hold code, it holds the credentials, tokens, and deployment keys that teams leave in their repositories, and read access to those is often read access to everything they unlock. This is the raw material of a software supply chain attack.

The timing follows a familiar and uncomfortable pattern. According to reporting on findings from Sysdig, threat actors began probing the flaw in Gitea's Docker images around thirteen days after disclosure, a reminder that the quiet gap after a patch ships is not safe time, it is a countdown, per The Hacker News.

Organizations running Gitea should update immediately, rotate any secrets that lived in reachable repositories, and comb access logs for unexpected reads. When the system that stores your source code can be opened with one header, the only safe assumption is that someone has already tried the door.

Sources: SecurityWeek, The Hacker News.

Affected versions and fix

• Affected: Gitea Docker images up to and including 1.26.2, which default REVERSE_PROXY_TRUSTED_PROXIES=* (trusts any source IP).

• Severity: CVSS 9.8 (Critical), CWE-284 improper access control, unauthenticated and network-reachable.

• Fix: update to the patched Gitea release and set REVERSE_PROXY_TRUSTED_PROXIES to your genuine proxy IPs only, never *.

The 13-day gap between disclosure and probing is the exposure window in miniature; see our analysis of the 2025 KEV exploitation timeline for why periodic testing misses exactly this.

Frequently asked questions

Can an attacker reach private repositories with CVE-2026-20896?

Yes. By spoofing a reverse-proxy authentication header such as X-WEBAUTH-USER, an unauthenticated attacker can impersonate any user and read private repositories and the secrets stored in them.

Which Gitea versions are affected, and how is it fixed?

Gitea Docker images up to and including 1.26.2 ship with REVERSE_PROXY_TRUSTED_PROXIES=* by default. Update to the patched release and restrict that setting to your real proxy IPs.

Is CVE-2026-20896 being exploited in the wild?

Sysdig observed threat actors probing Gitea Docker images about 13 days after disclosure. It is not yet in CISA KEV, but with a public root cause and a CVSS of 9.8 it should be treated as actively targeted.

How do I secure a self-hosted Gitea instance right now?

Update immediately, set REVERSE_PROXY_TRUSTED_PROXIES to only your genuine proxy addresses, rotate any secrets that lived in reachable repositories, and audit access logs for unexpected reads.

Why is this a software supply-chain risk?

Read access to source code and CI/CD secrets is the raw material for compromising everything those secrets unlock downstream, making a single exposed Gitea a foothold into the whole build pipeline.