CVE-2026-20896 Gitea X-WEBAUTH-USER Admin Impersonation via Header Injection

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•7

Detects anomalous process execution chains originating from Gitea or Gitea Act Runner processes. This rule is designed to catch post-exploitation behavior associated with CVE-2026-20896, where an improperly configured reverse proxy allows an attacker to impersonate an administrator. The detection identifies shells, scripting interpreters, and network utilities spawned by the Gitea service, which may indicate command injection, malicious git hook execution, or CI/CD job abuse following an unauthorized administrative access.