Security researchers are warning of active exploitation of an almost perfect-10 vulnerability in code repository management platform, Gitea.<\/p>\n
CVE-2026-20896 was patched in releases 1.26.3 and Gitea 1.26.4<\/a>, which were made available on June 21; however, 13 days later, hackers are targeting the bypass authentication flaw.<\/p>\n \n You\u2019re out of free articles for this month <\/p>\n
<\/p>\n \u201cCVE-2026-20896 exploited 13 days after disclosure. One HTTP header. Access on any internet-facing Gitea,\u201d warned Michael Clark<\/a>, Threat Research Director at cloud security firm Sysdig.<\/p>\n
<\/p>\n The issue, according to Clark, is that Gitea\u2019s Docker image ships with reverse-proxy authentication enabled, which in turn leads to Gitea trusting any source IP address \u201cso an unauthenticated internet client becomes whoever it claims to be,\u201d including admin.<\/p>\n
<\/p>\n \u201cNo password. No token. One header. Sysdig sensors caught the first in-the-wild hit 13 days after the advisory, a VPN-exit scanner that grabbed access,\u201d Clark said.<\/p>\n
<\/p>\n Clark said that once authenticated, a malicious user could then gain read and write access to code and anything else accidentally committed to the repository, such as database credentials, API keys, and deploy tokens.<\/p>\n
<\/p>\n