Gitea Authentication Bypass Exposes Private Repositories Through Default Docker Reverse Proxy Setting
A critical authentication bypass vulnerability has been demonstrated in Gitea, allowing attackers to impersonate administrators and access private repositories simply by sending one HTTP header. The flaw, assigned CVE-2026-20896 and rated 9.8 on the CVSS scale, stems from a dangerous default in the official Docker image that trusts the X-WEBAUTH-USER header from any IP address.
Root Cause and Attack Flow
Gitea supports authentication via a reverse proxy for single sign-on scenarios. When enabled, the proxy authenticates the user and passes the username in the X-WEBAUTH-USER header. The application trusts this header only from addresses listed in the REVERSE_PROXY_TRUSTED_PROXIES configuration option. In the official Docker image the default value was set to a wildcard (“*”), meaning any source could supply the header.
An attacker could therefore send a request such as:
curl -H 'X-WEBAUTH-USER: admin' http://target:3000/admin/secret-infra/raw/branch/main/.env
and immediately retrieve the contents of a private repository file containing production secrets.
Additional Related Vulnerabilities
The same pattern of broken access control appeared in several other Gitea components throughout 2026:
- CVE-2026-27771 – private container images were served anonymously through the built-in OCI registry.
- CVE-2026-22874 – an overly permissive allow-list allowed SSRF via webhooks and migrations.
- CVE-2026-28740 – authorization bypass in LFS permitted reading objects from private repositories without proper rights.
These issues affected both Gitea and its fork Forgejo, impacting tens of thousands of internet-facing instances.
Recommended Mitigations
Administrators are advised to:
- Upgrade to Gitea 1.26.4 or newer (avoid 1.26.3 due to a regression in the SSRF fix).
- Explicitly configure REVERSE_PROXY_TRUSTED_PROXIES to the IP or CIDR of the actual reverse proxy.
- Disable reverse-proxy authentication if it is not required.
- Place Gitea behind a reverse proxy or WAF and monitor logs for 200 responses to administrative paths from unexpected source IPs.
The researcher emphasizes that the incident is not an isolated coding error but a systemic problem caused by overly permissive defaults in official container images.
Related articles
CISA Adds Cisco Secure Firewall and GitLab Flaws to Known Exploited Vulnerabilities Catalog
US authorities have warned that two vulnerabilities in Cisco Systems firewall products and the GitLab development platform are being actively exploited in the wild. The Cybersecurity and Infrastructure Security Agency added CVE-2026-76418 and CVE-2026-97229 to its Known Exploited Vulnerabilities catalog on October 29, 2026, urging immediate remediation. CVE-2026-76418 affects Cisco Secure Firewall ASA Software and Cisco Secure FTD Software, allowing unauthenticated attackers to trigger device reboots and cause denial-of-service conditions. CVE-2026-97229 is an integer overflow in GitLab stemming from insufficient validation of regular expressions in CI/CD configurations, enabling remote code execution without authentication. CISA noted that the GitLab issue originates from a dependency in Ruby/Onigmo and may impact other products beyond GitLab itself. Organizations are advised to apply patches or mitigations without delay to prevent further exploitation.
Cisco ASA and FTD Face DoS Vulnerability in SSL VPN Already Exploited in the Wild
Cisco Systems has disclosed a denial-of-service vulnerability affecting its Cisco Secure Firewall ASA and Cisco Secure Firewall FTD products. The flaw, tracked as CVE-2026-76418, resides in the SSL VPN remote access feature and carries a CVSS v3.1 base score of 8.6, rated High severity. Exploitation occurs when secondary authentication is configured on tunnel groups, allowing an attacker to send a crafted request that forces a device reboot without requiring authentication. Cisco confirmed active exploitation of the issue in October 2026. Security updates addressing the vulnerability are now available for both affected product lines. The advisory recommends immediate application of the patches to prevent service disruption.
Critical Pre-Auth RCE Vulnerability CVE-2026-118633 Affects All Sophos UTM Versions, Manual Patch Required After EOL
Sophos has disclosed a critical remote code execution vulnerability in its legacy Sophos UTM security gateway product. The flaw, tracked as CVE-2026-118633, carries a CVSSv4.0 base score of 9.2 and is rated Critical. It allows unauthenticated attackers to execute arbitrary commands as root by triggering a race condition through repeated attacks against the email proxy when scanning is enabled. Although the product reached end-of-life, Sophos released a manual patch that users must apply themselves because automatic updates are no longer available. The company urges immediate patching for any deployments still using the email protection feature and recommends migration to the supported Sophos Firewall. The issue was reported through Sophos’s bug bounty program by an external researcher.
PHP2Shell Campaign Chains PHP and Linux Kernel Flaws to Compromise 25 Servers Including US Government-Linked Network
Israeli security firm Dream disclosed a sophisticated campaign that achieved root access on 25 servers by chaining two remote code execution vulnerabilities in PHP2Shell with a Linux kernel flaw. The attackers targeted 24 perimeter firewalls from a single unnamed vendor plus one internal management server across the United States, Japan, Taiwan, and South Korea. Three of the compromised devices belonged to an environment connected to the US government, where the intrusion led to domain controller access and Active Directory enumeration. The attack chain began with CVE-2026-109618 and CVE-2026-109619, which granted initial web server access, and escalated via CVE-2026-46300 (Fragnesia) to obtain root privileges. Dream observed extensive reconnaissance using the Chinese search engine FOFA, with indicators pointing to Chinese-language tooling and timing, though no specific threat actor was attributed.