Executive Summary
CVE-2026-20896 is a critical authentication bypass vulnerability in Gitea, a self-hosted Git server, arising from insecure default configurations in its official Docker image. Specifically, the Docker image is distributed with `REVERSE_PROXY_TRUSTED_PROXIES=*`, which instructs the application to trust authentication headers from any source IP. If reverse-proxy authentication is enabled, an attacker can impersonate any user, including administrators, by simply providing a username in the `X-WEBAUTH-USER` header.
Technical exploitation was observed in the wild 13 days after disclosure, involving VPN-based scanners targeting the roughly 6,200 Gitea instances exposed globally on the internet. Because Gitea often contains proprietary source code, secrets, and CI/CD configurations, successful exploitation poses a severe risk of supply chain compromise and lateral movement.
Organizations should immediately restrict trusted proxy settings or disable reverse-proxy authentication if not required. The prevalence of this vulnerability among cloud hosting providers like Hetzner, Linode, and Aliyun suggests a high risk for cloud-deployed developer infrastructure.