Hackers Exploit Critical Gitea Docker Flaw to Impersonate Admin Users
Hackers are actively exploiting a critical authentication bypass vulnerability in the official Docker image for Gitea, a popular open-source alternative to GitHub and GitLab. The flaw, tracked as CVE-2026-20896, allows unauthenticated attackers to impersonate any user, including administrators, by sending a single spoofed HTTP header. Security researchers at Sysdig confirm that in-the-wild exploitation began within days of the vulnerability's public disclosure.
The problem stems from Gitea's official Docker image, which ships with reverse proxy authentication enabled and configured to trust identity headers from any IP address. This means that any client who can reach the Gitea container's HTTP port directly can become any user whose login name is known or guessed, requiring no password or token. Admin accounts with predictable names like "admin" or "gitea_admin" are the primary targets. Approximately 6,200 Gitea instances are currently exposed on the public web, though the exact number running vulnerable configurations remains unclear.
Gitea has released versions 1.26.3 and 1.26.4 to address the flaw and strongly advises users to upgrade to the latest release immediately, as it also fixes a regression introduced in the earlier patch. Singapore's cybersecurity agency has issued a warning about active exploitation and recommends restricting network access to Gitea containers as a fallback measure for organizations unable to upgrade right away.