Gitea Authentication Bypass Exposes Private Repositories Through Default Docker Reverse Proxy Setting
A critical authentication bypass vulnerability has been demonstrated in Gitea, allowing attackers to impersonate administrators and access private repositories simply by sending one HTTP header. The flaw, assigned CVE-2026-20896 and rated 9.8 on the CVSS scale, stems from a dangerous default in the official Docker image that trusts the X-WEBAUTH-USER header from any IP address.
Root Cause and Attack Flow
Gitea supports authentication via a reverse proxy for single sign-on scenarios. When enabled, the proxy authenticates the user and passes the username in the X-WEBAUTH-USER header. The application trusts this header only from addresses listed in the REVERSE_PROXY_TRUSTED_PROXIES configuration option. In the official Docker image the default value was set to a wildcard (“*”), meaning any source could supply the header.
An attacker could therefore send a request such as:
curl -H 'X-WEBAUTH-USER: admin' http://target:3000/admin/secret-infra/raw/branch/main/.env
and immediately retrieve the contents of a private repository file containing production secrets.
Additional Related Vulnerabilities
The same pattern of broken access control appeared in several other Gitea components throughout 2026:
- CVE-2026-27771 – private container images were served anonymously through the built-in OCI registry.
- CVE-2026-22874 – an overly permissive allow-list allowed SSRF via webhooks and migrations.
- CVE-2026-28740 – authorization bypass in LFS permitted reading objects from private repositories without proper rights.
These issues affected both Gitea and its fork Forgejo, impacting tens of thousands of internet-facing instances.
Recommended Mitigations
Administrators are advised to:
- Upgrade to Gitea 1.26.4 or newer (avoid 1.26.3 due to a regression in the SSRF fix).
- Explicitly configure REVERSE_PROXY_TRUSTED_PROXIES to the IP or CIDR of the actual reverse proxy.
- Disable reverse-proxy authentication if it is not required.
- Place Gitea behind a reverse proxy or WAF and monitor logs for 200 responses to administrative paths from unexpected source IPs.
The researcher emphasizes that the incident is not an isolated coding error but a systemic problem caused by overly permissive defaults in official container images.
Related articles
CISA Adds Three Actively Exploited Linux Kernel Vulnerabilities to KEV Catalog
The U.S. Cybersecurity and Infrastructure Security Agency has added three vulnerabilities affecting the Linux Kernel to its Known Exploited Vulnerabilities catalog. The flaws, identified as CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964, are confirmed to be under active exploitation in the wild. CISA is directing all federal agencies to apply patches immediately and to search for indicators of compromise. The vulnerabilities impact the kernel's kTLS TLS processing, the ebtables network bridge component, and the AF_ALG cryptographic interface. Each issue can lead to memory corruption or inconsistent internal state that attackers may leverage for privilege escalation or remote code execution.
Keycloak Cluster on Three VMs: Engineers Detail Embedded Infinispan Setup, HA Testing Failures, and Bug Fix
A team deployed Keycloak for 25,000–30,000 users across a country using three isolated VMs instead of Kubernetes. They chose Embedded Infinispan with JGroups over an external cluster to reduce failure points and maintain session replication. PostgreSQL with Patroni handled shared storage and JDBC_PING discovery. Testing revealed that full datacenter outages triggered split-brain conditions and 5xx errors that the built-in healthcheck could not resolve. The engineers wrote a Python watcher script to detect multiple coordinators in the JGROUPS_PING table and restart affected containers. They reported the recovery bug to the Keycloak project, which was confirmed and fixed in a later release. The production cluster now survives single-DC loss without session loss.
From UDP Probe to Working Tunnel: Analyzing Hysteria2 Behavior via QUIC, HTTP/3 and Client Events
A detailed technical study examined how commercial Hysteria2 VPN endpoints respond to different levels of network probing, starting from simple UDP packets and progressing to full QUIC handshakes and authenticated client connections. The research used custom NetProbe tools on Windows and Linux to test real subscription endpoints, capturing both external probe results and decrypted traffic from an instrumented Hysteria2 client. Simple UDP probes received no response and timed out, while properly formed QUIC Initial packets with TLS ClientHello and ALPN h3 successfully completed handshakes using TLS 1.3 and TLS_AES_256_GCM_SHA384. An unauthenticated HTTP/3 GET request triggered immediate connection closure with H3_NO_ERROR (code 0x100), whereas a legitimate client sending POST /auth with Hysteria-Auth headers received the expected 233 status confirming authentication and UDP forwarding support. Subsequent data transfer tests, including parallel requests and file downloads, were observed inside separate QUIC streams after authentication, confirming that the tunnel carried real traffic. The study highlights differences between external probing and authenticated client behavior, providing practical insight into how Hysteria2 servers handle reconnaissance versus legitimate VPN usage.
Unbound 1.26.1 Patches Critical DNSSEC Validator Flaw CVE-2026-81642 Enabling Remote Code Execution
NLnet Labs has released Unbound 1.26.1 to address CVE-2026-81642, a critical vulnerability in the DNSSEC validator that can cause service crashes and potential remote code execution. The flaw affects all versions up to and including 1.26.0 and is triggered when validating a malicious DNS zone. It resides in the handling of DNSKEY records, where a buffer overflow can occur during DNS response processing. The vulnerability carries a CVSS 4.0 score of 9.1 with a network attack vector, no privileges required, and no user interaction needed. Exploitation requires an attacker to control a malicious DNS zone that the resolver queries, which can lead to denial of service or RCE in the worst case. The update also includes fixes for eight additional security issues, including CVE-2026-82717 and CVE-2026-81634, both involving heap corruption.