CRITICAL CWE-284
CVE-2026-20896
Gitea Docker image trusts spoofable reverse-proxy headers by default
Gitea·Open Source Git Server
9.8/ 10
CVSS 3.1
Critical severity
2.8%
EPSS exploit odds
Chance of exploitation in the next 30 days
Higher than 86% of all CVEs
Not listed
CISA KEV catalog
No confirmed in-the-wild exploitation on CISA's list, but a public proof of concept exists.
Timeline
- Published
- Jul 3, 2026
- Updated
- Jul 7, 2026
- First covered
- Jul 6, 2026
- Latest story
- 4 months ago
Summary
Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled.
Attack profile
Attack vectorNetwork
ComplexityLow
PrivilegesNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HAffected products
- Gitea Open Source Git Serverup to 1.26.2