Is CVE-2026-20896 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-20896 being exploited in the wild.

How severe is CVE-2026-20896?

Critical severity, with a CVSS score of 9.8, published 3 July 2026.

Which products and versions are affected?

Gitea Docker Image < 1.26.3, <= 1.26.2; code.gitea.io/gitea (Go) < 1.26.3, SEMVER:introduced=0,fixed=1.26.3.

Is there a fix for CVE-2026-20896?

Yes. code.gitea.io/gitea (Go): upgrade to 1.26.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-20896 attacked?

It is attacked over the network.

Am I affected by CVE-2026-20896?

Check whether you run Gitea Docker Image or code.gitea.io/gitea (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-20896: Gitea Docker image authentication bypass via trusted proxy misconfiguration

Q: Which products and versions are affected?

Gitea Docker Image < 1.26.3, <= 1.26.2; code.gitea.io/gitea (Go) < 1.26.3, SEMVER:introduced=0,fixed=1.26.3.

Q: Is there a fix for CVE-2026-20896?

Yes. code.gitea.io/gitea (Go): upgrade to 1.26.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-20896 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-20896?

Check whether you run Gitea Docker Image or code.gitea.io/gitea (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-20896 · Severity: critical · CVSS 9.8 · Published 2026-07-03

Gitea is a popular self-hosted Git service. A security issue in its official Docker images allows anyone who can reach the server to log in as any user, including administrators, without a password. This could lead to a total takeover of the Git server, exposure of private source code, and disruption of development operations.

Technologies: code.gitea.io/gitea (Go). Vendors: Gitea, Go.

Quick answers

Is CVE-2026-20896 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-20896 being exploited in the wild.
How severe is CVE-2026-20896?: Critical severity, with a CVSS score of 9.8, published 3 July 2026.
Which products and versions are affected?: Gitea Docker Image < 1.26.3, <= 1.26.2; code.gitea.io/gitea (Go) < 1.26.3, SEMVER:introduced=0,fixed=1.26.3.
Is there a fix for CVE-2026-20896?: Yes. code.gitea.io/gitea (Go): upgrade to 1.26.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-20896 attacked?: It is attacked over the network.
Am I affected by CVE-2026-20896?: Check whether you run Gitea Docker Image or code.gitea.io/gitea (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

code.gitea.io/gitea (Go): upgrade to 1.26.3 or later
```
go get code.gitea.io/gitea@v1.26.3
```

Technical details

The Gitea Docker images ship with a hard-coded configuration setting `REVERSE_PROXY_TRUSTED_PROXIES = *` in the `app.ini` template. When an administrator enables `ENABLE_REVERSE_PROXY_AUTHENTICATION`, Gitea is designed to trust identity information provided in HTTP headers (like `X-WEBAUTH-USER`) from a trusted proxy. Because the Docker image trusts all source IPs by default instead of just the loopback address, any network-reachable attacker can bypass authentication by sending a crafted HTTP header with a target username. This vulnerability affects Docker-based deployments of Gitea versions prior to 1.26.3. Users should upgrade to version 1.26.3 or manually restrict the `REVERSE_PROXY_TRUSTED_PROXIES` setting to specific trusted IP addresses.

Affected products

Gitea Gitea Docker Image < 1.26.3

Identifiers

CVE-2026-20896
GHSA-f75j-4cw6-rmx4
GO-2026-6051

Timeline

2026-06-21: disclosed
2026-07-03: advisory: NVD publication date
2026-07-21: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.