Gitea Docker reverse-proxy authentication bypass via trusted-proxy wildcard default

CVE-2026-20896 is a pre-auth authentication bypass in self-hosted Gitea instances deployed from the official Docker images. The image template shipped with REVERSE_PROXY_TRUSTED_PROXIES = *, so when reverse-proxy header auth is enabled, Gitea will accept an X-WEBAUTH-USER: admin header from *any* source IP and log the caller in as that user — no cookie, no password, no MFA. Affected versions are all Gitea Docker builds prior to 1.26.3; the fix pins trusted proxies to loopback and makes header auth opt-in.

There is no assigned vendor CVSS, but the community estimate of 9.8 is honest. This is a canonical supply-chain-tier compromise: attacker becomes admin on your source-code system, which means source theft, backdoored commits, stolen CI tokens, webhooks pointed anywhere, and SSH keys minted at will. Community severity matches reality — the only reason to soften it is if your Gitea isn't Docker-deployed or you never turned on reverse-proxy auth.

Why this verdict

• Pre-auth, one-request, network-reachable: no credentials, no user interaction, no chaining. The friction audit finds essentially zero attacker prerequisites beyond HTTP reachability.
• Role multiplier — source control is supply-chain-tier: Gitea holds source, signing config, CI secrets, and Actions workflows. Admin takeover = code theft + backdoored commits + runner RCE. Floor is CRITICAL by the noisgate role-multiplier rule (supply-chain pivot on a canonical high-value role component).
• Active exploitation + zero-day drop: the disclosure path was a public PoC dump, not coordinated disclosure. The window between patch availability and mass scanning is measured in days.
• Population is non-trivial: the vulnerable configuration was the *default* in official Docker images. Any team that stood up Gitea via docker run and then enabled reverse-proxy SSO (a common pattern behind Traefik/NGINX + Authelia) is exposed.
• Downward adjustment applied but bounded: bare-metal installs without reverse-proxy auth are not vulnerable. That trims population, not blast radius — so the verdict sits at CRITICAL rather than being pushed to a 9.8 ceiling.

Why not higher?

The bug is not universal to every Gitea install — reverse-proxy header auth must be enabled, and hardened deployments that pin REVERSE_PROXY_TRUSTED_PROXIES to a specific CIDR are unaffected. That population narrowing is the reason the score sits at 9.4 rather than a flat 9.8/10.

Why not lower?

Downgrading to HIGH would require either an authentication prerequisite or a role narrowing — neither exists. Gitea is source control; unauthenticated admin takeover on source control is definitionally a supply-chain-tier compromise, and the noisgate role-multiplier floor prevents dropping below CRITICAL when the canonical deployment role is high-value and exploitation is trivial.

1. Pin REVERSE_PROXY_TRUSTED_PROXIES immediately — Edit app.ini (or the Docker env var) from * to your actual reverse-proxy IPs or 127.0.0.1,::1. This is the single-line fix and it neutralizes the exploit even before you upgrade. Deploy within the noisgate mitigation SLA of 3 days.
2. Disable reverse-proxy header auth if you don't use it — Set ENABLE_REVERSE_PROXY_AUTHENTICATION = false in app.ini. Most teams enabled this speculatively and never wired it up — turning it off costs nothing and kills the class. Do this within 3 days.
3. Strip X-WEBAUTH-USER at the reverse proxy — Add an NGINX proxy_set_header X-WEBAUTH-USER ""; or Traefik headers.customRequestHeaders rule to unconditionally clear the header on inbound traffic — belt-and-braces defense that survives future config drift. Deploy within 3 days.
4. Upgrade to Gitea 1.26.3+ — This is the durable fix — trusted-proxy defaults are corrected and header auth is opt-in. Apply within the noisgate remediation SLA of 90 days, but given active exploitation aim for the current maintenance window (this week).
5. Rotate all admin PATs and SSH keys — Assume compromise until proven otherwise. Force-expire personal access tokens (/-/admin/applications), rotate SSH deploy keys, and rebuild any Actions runners that may have executed attacker workflows. Complete within 7 days.
6. Hunt in audit logs for admin logins with X-WEBAUTH-USER — Grep NGINX/Traefik access logs for requests bearing the header from non-proxy source IPs; cross-reference against Gitea audit log admin sessions from unfamiliar IPs. Any hit is a confirmed breach.

Run this from an auditor workstation with network reach to the Gitea instance — no credentials required, this is a black-box check. Invoke as ./check-cve-2026-20896.sh https://gitea.internal.example.com. If you want a config-side check instead, SSH to the host and inspect app.ini directly (script prints the exact grep at the end).

#!/usr/bin/env bash
# noisgate verification for CVE-2026-20896 — Gitea reverse-proxy auth bypass
# Usage: ./check-cve-2026-20896.sh https://gitea.example.com
set -u
TARGET="${1:-}"
if [[ -z "$TARGET" ]]; then
  echo "Usage: $0 <gitea-base-url>" >&2
  exit 2
fi

# 1. Fingerprint Gitea version
VERSION_JSON=$(curl -sk --max-time 10 "$TARGET/api/v1/version" || true)
VERSION=$(echo "$VERSION_JSON" | grep -oE '"version":"[^"]+"' | cut -d'"' -f4)
if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN — could not reach $TARGET/api/v1/version"
  exit 3
fi
echo "[i] Detected Gitea version: $VERSION"

# 2. Version gate — anything >= 1.26.3 is patched
major=$(echo "$VERSION" | cut -d. -f1)
minor=$(echo "$VERSION" | cut -d. -f2)
patch=$(echo "$VERSION" | cut -d. -f3 | grep -oE '^[0-9]+')
if (( major > 1 )) || (( major == 1 && minor > 26 )) || (( major == 1 && minor == 26 && patch >= 3 )); then
  echo "PATCHED — Gitea $VERSION is at or above 1.26.3"
  exit 0
fi

# 3. Behavioural probe — send X-WEBAUTH-USER and check for auth
PROBE=$(curl -sk --max-time 10 -o /dev/null -w '%{http_code}|%{header_json}' \
  -H 'X-WEBAUTH-USER: __noisgate_probe_user__' \
  "$TARGET/user/settings")
HTTP_CODE=$(echo "$PROBE" | cut -d'|' -f1)

# A vulnerable instance with header auth enabled will 302 to a create-user
# or return 200 for a session; a hardened instance returns 302 to /user/login.
if [[ "$HTTP_CODE" == "200" ]] || [[ "$HTTP_CODE" == "302" && "$PROBE" != *"/user/login"* ]]; then
  echo "VULNERABLE — $VERSION < 1.26.3 AND header auth appears trusted (HTTP $HTTP_CODE)"
  echo "    Config-side check on the host:"
  echo "      grep -E 'ENABLE_REVERSE_PROXY_AUTHENTICATION|REVERSE_PROXY_TRUSTED_PROXIES' /etc/gitea/app.ini"
  exit 1
fi

echo "VULNERABLE (version) — $VERSION < 1.26.3; header-auth probe was inconclusive (HTTP $HTTP_CODE), verify app.ini manually"
exit 1

Sources

1. Feedly CVE-2026-20896 entry
2. IT-Connect — Exploitarium researcher exposes zero-day flaws in 15 open source projects
3. The Register — Anonymous researcher drops 0-day 'exploitarium' repo
4. SC Media — Anonymous researcher dumps zero-day exploits for multiple software products
5. byteiota — Exploitarium: 130 0-Days Dropped—Two Are Critical Now
6. Cybersec Brief — Daily Cybersecurity Briefing (30 June 2026)
7. Gitea documentation — Reverse Proxy authentication
8. CISA Vulnerability Summary Week of June 8, 2026