CVE-2026-20896

This vulnerability allows complete authentication bypass on Gitea instances deployed via Docker. The root cause is the default value of REVERSE_PROXY_TRUSTED_PROXIES set to `*` in the official Docker image, which tells Gitea to trust the X-WEBAUTH-USER and similar authentication headers from any source IP address. In practice, this means an attacker who can reach your Gitea instance over the network can simply include an HTTP header like `X-WEBAUTH-USER: admin` and gain immediate access to any account—without knowing any credentials. Repository data, SSH keys, and organizational settings are all exposed. The EPSS score of 0.31809 indicates approximately a 32% probability of active exploitation within the next 30 days, meaning this is being scanned for and exploited in the wild. If your Gitea instance is accessible from networks you don't fully control—cloud deployments, CI/CD integrations, or any exposure beyond a strictly isolated private network—you should treat this as a critical priority. To remediate, you must explicitly configure REVERSE_PROXY_TRUSTED_PROXIES to the actual IP addresses or CIDR ranges of your trusted reverse proxies. If you run Gitea directly without a proxy in front of it, set the value to an empty string or `127.0.0.1`. If you use a reverse proxy, configure exactly that proxy's IP or subnet. After applying the fix, verify that direct header injection no longer works by attempting a request with X-WEBAUTH-USER to an endpoint that should require authentication. This case illustrates a broader pattern: container images ship with security-relevant defaults that made sense in earlier deployment contexts (self-hosted instances behind corporate VPNs in 2016) but became dangerous as deployment patterns shifted to cloud-exposed infrastructure. The vulnerability is as severe as the CVSS 9.8 suggests—full account takeover—but the fix is straightforward. The challenge is identifying which instances are affected, as many operators may not realize their Docker deployment defaulted to universal proxy trust.

Reviewed through automated stages and approved by a human before publication.