CVE-2026-20896: Gitea Docker image trusts spoofable reverse-proxy headers by default

Synopsis

This is an authentication bypass vulnerability in the official Gitea Docker image (versions up to and including 1.26.2). The image ships with REVERSE_PROXY_TRUSTED_PROXIES=* by default, meaning any remote host on the network can send an X-WEBAUTH-USER header and impersonate any Gitea account, including site administrators, without supplying credentials. Successful exploitation gives an attacker full read and write access to all repositories and user data, and can crash or corrupt the service. HarborGuard tracks this advisory for patch availability and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to send HTTP requests to the Gitea service over the network; any host that can reach the exposed port is a potential source of spoofed headers.

• AuthenticationNot required

  No credentials are needed; the default REVERSE_PROXY_TRUSTED_PROXIES=* configuration causes Gitea to accept identity headers from any source without verification.

• Victim interactionNot required

  No user action is needed; the attacker sends a crafted request directly to the Gitea endpoint and the server processes it immediately.

• Attack complexityDetail

  The exploit is reliable and condition-free: the attacker only needs to set an HTTP header to an arbitrary username, with no race conditions or environmental dependencies.

Blast Radius

• Reads any repository content, including private repositories and stored secrets committed to code.
• Modifies or deletes repository data, branches, and releases across any project on the instance.
• Impersonates administrators to change user accounts, revoke access, or alter site-wide settings.
• Disrupts service availability by abusing administrative APIs to corrupt configuration or exhaust resources.