Gitea CVE-2026-20896 X-WEBAUTH-USER Header Injection Admin Impersonation

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•12

Detects anomalous process execution chains originating from the Gitea server or Gitea act-runner processes following the exploitation of CVE-2026-20896. This vulnerability allows an attacker to bypass authentication using a forged X-WEBAUTH-USER header when REVERSE_PROXY_TRUSTED_PROXIES is insecurely configured. The rule identifies subsequent command-line activity such as spawning shells, using network utilities (wget, curl, netcat), or executing Gitea administrative commands by unauthorized child processes.