# CVE-2026-20896: Gitea Docker image authentication bypass via trusted proxy misconfiguration

Source: https://junglewise.ai/threats/cve-2026-20896-gitea-docker-image-authentication-bypass-via-trusted-proxy  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-03. Updated: 2026-07-21  
License: CC BY 4.0 with a link back

CVE-2026-20896 · Severity: critical · CVSS 9.8 · Published 2026-07-03

Gitea is a popular self-hosted Git service. A security issue in its official Docker images allows anyone who can reach the server to log in as any user, including administrators, without a password. This could lead to a total takeover of the Git server, exposure of private source code, and disruption of development operations.

Technologies: [code.gitea.io/gitea (Go)](https://junglewise.ai/threats/technologies/code-gitea-io-gitea). Vendors: [Gitea](https://junglewise.ai/threats/vendors/gitea), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-20896 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-20896 being exploited in the wild.

**How severe is CVE-2026-20896?** Critical severity, with a CVSS score of 9.8, published 3 July 2026.

**Which products and versions are affected?** Gitea Docker Image < 1.26.3, <= 1.26.2; code.gitea.io/gitea (Go) < 1.26.3, SEMVER:introduced=0,fixed=1.26.3.

**Is there a fix for CVE-2026-20896?** Yes. code.gitea.io/gitea (Go): upgrade to 1.26.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-20896 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-20896?** Check whether you run Gitea Docker Image or code.gitea.io/gitea (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- code.gitea.io/gitea (Go): upgrade to 1.26.3 or later

  ```sh
  go get code.gitea.io/gitea@v1.26.3
  ```


## Technical details

The Gitea Docker images ship with a hard-coded configuration setting `REVERSE_PROXY_TRUSTED_PROXIES = *` in the `app.ini` template. When an administrator enables `ENABLE_REVERSE_PROXY_AUTHENTICATION`, Gitea is designed to trust identity information provided in HTTP headers (like `X-WEBAUTH-USER`) from a trusted proxy. Because the Docker image trusts all source IPs by default instead of just the loopback address, any network-reachable attacker can bypass authentication by sending a crafted HTTP header with a target username. This vulnerability affects Docker-based deployments of Gitea versions prior to 1.26.3. Users should upgrade to version 1.26.3 or manually restrict the `REVERSE_PROXY_TRUSTED_PROXIES` setting to specific trusted IP addresses.

## Affected products

- Gitea Gitea Docker Image < 1.26.3

## Identifiers

- CVE-2026-20896
- GHSA-f75j-4cw6-rmx4
- GO-2026-6051

## Timeline

- 2026-06-21: disclosed
- 2026-07-03: advisory: NVD publication date
- 2026-07-21: advisory: GitHub Advisory published

## References

- [https://api.github.com/users/rz1027](https://api.github.com/users/rz1027)
- [https://github.com/rz1027](https://github.com/rz1027)
- [https://api.github.com/users/rz1027/gists%7B/gist_id%7D](https://api.github.com/users/rz1027/gists%7B/gist_id%7D)
- [https://api.github.com/users/rz1027/repos](https://api.github.com/users/rz1027/repos)
- [https://avatars.githubusercontent.com/u/53318196?v=4](https://avatars.githubusercontent.com/u/53318196?v=4)
- [https://api.github.com/users/rz1027/events%7B/privacy%7D](https://api.github.com/users/rz1027/events%7B/privacy%7D)

## Related threats

- [Gitea incorrect authorization in starred repos and tracked times API](https://junglewise.ai/threats/cve-2026-59766-gitea-incorrect-authorization-in-starred-repos-and-tracked-times)
- [Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.](https://junglewise.ai/threats/cve-2026-60004-gitea-code-injection-in-diffpatch-api)
- [SSRF via Migration Asset Downloads Bypasses hostmatcher , Reads Internal Files and Cloud Metadata](https://junglewise.ai/threats/cve-2026-59765-gitea-ssrf-and-local-file-read-via-migration-asset-bypass)
- [Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads](https://junglewise.ai/threats/cve-2026-59763-gitea-resource-amplification-in-arch-package-metadata-parsing)
- [Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher , Reads Internal Files and Cloud Metadata](https://junglewise.ai/threats/cve-2026-34966-gitea-ssrf-via-migration-asset-downloads-bypasses-hostmatcher)