Threat Actors Mass-Probe Gitea Docker Deployments for CVE-2026-20896 Authentication Bypass Amid Exploitarium Zero-Day Leak Wave
Threat Actors Mass-Probe Gitea Docker Deployments for (TL-2026-1136), also tracked as Gitea Docker Auth Bypass, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-07-06. It is attributed to Opportunistic Scanning Actors with low confidence, affects Gitea Gitea (official Docker image), references 6 CVEs (CVE-2026-20896, CVE-2026-27771, CVE-2026-22874), maps to 22 MITRE ATT&CK techniques (T1021, T1068, T1087), and is covered by 9 detection rules and 21 indicators of compromise.
Key facts for TL-2026-1136
- Threat ID
- TL-2026-1136
- Also known as
- Gitea Docker Auth Bypass, X-WEBAUTH-USER Bypass, Exploitarium Gitea Exploitation Wave
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-07-06
- Last reviewed
- 2026-07-06
- Attribution
- Opportunistic Scanning Actors
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, softwaredevelopment, health, aerospace, retail
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 21
Malware and tooling in Threat Actors Mass-Probe Gitea Docker Deployments for
Malware and tooling: act_runner (act v0.262.0 dependency)
A cluster of critical Gitea vulnerabilities disclosed between May and June 2026 - led by CVE-2026-20896, a CVSS 9.8 Docker-image authentication bypass exploitable with a single X-WEBAUTH-USER HTTP header - is being actively probed and exploited following the anonymous 'Exploitarium' mass zero-day PoC dump and the subsequent resale of those exploits on the darkforums.ru cybercrime forum. Automated scanners can identify and weaponize exposed, unpatched self-hosted Gitea/Docker instances at internet scale with a single crafted request.
How Threat Actors Mass-Probe Gitea Docker Deployments for works
Gitea, a widely deployed self-hosted Git service, went through a sustained security crisis across Q2 2026 that produced a cluster of critical vulnerabilities now being actively probed by opportunistic threat actors. The centerpiece is CVE-2026-20896 (CVSS 9.8), disclosed via GitHub Security Advisory GHSA-f75j-4cw6-rmx4 on 2026-06-21 and credited to researcher 'bircni'. Gitea's official Docker images shipped with REVERSE_PROXY_TRUSTED_PROXIES set to '*' by default. When an administrator enables ENABLE_REVERSE_PROXY_AUTHENTICATION=true to front Gitea with an SSO-validating reverse proxy, Gitea is supposed to trust the X-WEBAUTH-USER identity header only from the proxy's own loopback connection. Because the Docker image's default trusted-proxies value was a wildcard, Gitea instead trusted X-WEBAUTH-USER from any source IP able to reach the container. The result: any HTTP client - an internal user, an external attacker who can reach the Gitea port, or an automated scanner - could send a single header, X-WEBAUTH-USER: admin, and receive full administrative control of the Git server, including every repository, embedded SSH keys, CI/CD pipeline definitions, and stored secrets, with zero authentication preconditions. CVE-2026-20896 was confirmed actively exploited in the wild at the time of its public disclosure, and because the exploit requires only a single crafted header, analysts assess that internet-wide automated scanning tools were positioned to identify and weaponize the flaw at scale for as long as the vulnerable default remained deployed. The fix (reverse-proxy authentication is now opt-in and admin-configured) shipped in Gitea 1.26.3 (2026-06-18) and was carried forward into 1.26.4 (2026-06-21), which is the recommended update target since 1.26.3 introduced an unrelated repository code-page regression. The same 1.26.3/1.26.4 release bundle also fixed three related issues: CVE-2026-22874 (an incomplete SSRF allow-list in webhooks and repository migrations that could reach internal addresses), CVE-2026-27775 (a pre-receive hook privilege-escalation bug where the first pushed ref's permission check was cached and reused for all subsequent refs, letting a per-branch maintainer-edit grant escalate to full repository write), and CVE-2026-25038 (an information-disclosure flaw where private organization labels leaked through label-read endpoints to non-members). This followed an earlier, independently disclosed Gitea flaw, CVE-2026-27771 (CVSS 8.2), an access-control failure in Gitea's built-in OCI container registry that let unauthenticated remote attackers pull images marked private without any credentials; discovered by NoScope's autonomous penetration-testing agent in April 2026, responsibly disclosed, fixed in Gitea 1.26.2 (2026-05-20), and publicized by The Hacker News and SecurityWeek in late May 2026 as affecting an estimated 30,000+ internet-facing deployments across 30+ countries, left exposed for close to four years. A third, separate critical flaw, CVE-2026-58053 (CVSS 9.9), was disclosed on 2026-06-28 in Gitea's act_runner CI/CD component: when act_runner uses the Docker backend, a workflow's container.options string is passed unsanitized into the job container's Docker HostConfig, so options such as --pid=host, --cap-add, and --security-opt survive even though the privileged flag itself is correctly disabled - allowing any user with workflow-definition privileges to escape the job container and obtain root on the host. The threat-actor angle driving active exploitation of this vulnerability cluster centers on the 'Exploitarium' incident: on 2026-06-23, an anonymous GitHub account using the handle 'bikini' published a now-removed repository containing 130+ working proof-of-concept exploits spanning 22 open-source projects - including Gitea, libssh2, Splunk, RustDesk, 7-Zip, VLC, AnyDesk, OpenVPN, c-ares, and Floci - without any prior vendor notification, explicitly inviting the security community to report the flaws and claim CVE credit. The dump included PoC material touching the Gitea Docker auth bypass as well as a separate, unrelated libssh2 pre-authentication heap-write RCE (CVE-2026-55200) that has also seen confirmed in-the-wild exploitation. The Register and multiple other outlets amplified awareness of the leak within days. Shortly after, a threat actor began advertising 'zero-day' exploits for Gitea, libssh, c-ares, and Floci on the darkforums.ru cybercrime forum, claiming exclusive, unpatched access; threat-intelligence analysis (femtosec) assesses this listing as an underground resale/relabeling of the already-public Exploitarium PoCs intended to defraud other criminal buyers, rather than genuine undisclosed zero-days - but the PoC code itself is fully functional and any actor, criminal or otherwise, can retrieve it directly from the public leak at no cost. This combination - a trivially exploitable, confirmed-active CVSS 9.8 authentication bypass, a public cache of working exploit code, and criminal marketplace amplification - is what is driving reported mass probing/scanning activity against internet-facing Gitea Docker deployments. Note on sourcing: the specific July 2026 news article that originally prompted this threat record could not be retrieved for direct verification after repeated attempts (HTTP 403 Forbidden on both direct fetch and an alternate fetch proxy), and no exact-match article could be located via search. This record is therefore grounded instead in the independently corroborated underlying CVE-2026-20896 disclosure, the related Gitea CVE cluster, and the Exploitarium/darkforums.ru exploitation context, all confirmed across multiple independent sources. Organizations running self-hosted Gitea via Docker should treat any internet-reachable instance running 1.26.2 or earlier as compromised-until-proven-otherwise and prioritize immediate patching and log review.
MITRE ATT&CK techniques used in TL-2026-1136
Lateral Movement
T1021 Remote Services; T1550 Use Alternate Authentication Material
Privilege Escalation
T1068 Exploitation for Privilege Escalation; T1611 Escape to Host
Discovery
T1087 Account Discovery; T1613 Container and Resource Discovery
Persistence
T1098 Account Manipulation; T1136 Create Account
Initial Access
T1190 Exploit Public-Facing Application; T1195 Supply Chain Compromise
Collection
T1213 Data from Information Repositories
Credential Access
T1528 Steal Application Access Token; T1552 Unsecured Credentials
defense-impairment
T1556 Modify Authentication Process
Impact
Exfiltration
T1567 Exfiltration Over Web Service
Resource Development
T1588 Obtain Capabilities; T1650 Acquire Access
Reconnaissance
T1595 Active Scanning; T1596 Search Open Technical Databases
Execution
T1609 Container Administration Command
execution
Affected products and versions in Threat Actors Mass-Probe Gitea Docker Deployments for
- Gitea — Gitea (official Docker image)
Vulnerable versions: <=1.26.2 Docker images with default REVERSE_PROXY_TRUSTED_PROXIES=*
Fixed in: 1.26.3; 1.26.4 (recommended) - Gitea — Gitea built-in container/OCI package registry
Vulnerable versions: < 1.26.2
Fixed in: 1.26.2 - Gitea — act_runner (Gitea Actions CI/CD runner, Docker backend)
Vulnerable versions: act dependency <=0.262.0
Fixed in: patched release with container.options sanitization (CVE-2026-58053 fix)
Remediation for Threat Actors Mass-Probe Gitea Docker Deployments for
Patches
- Gitea 1.26.2 (fixes CVE-2026-27771)
- Gitea 1.26.3 (fixes CVE-2026-20896, CVE-2026-22874, CVE-2026-27775, CVE-2026-25038)
- Gitea 1.26.4 (fixes 1.26.3 code-page regression; recommended update target)
- act_runner/act patch addressing CVE-2026-58053 container.options sanitization
Immediate actions
- Update all Gitea Docker deployments to 1.26.4 (do not stop at 1.26.3, which carries an unrelated repository code-page regression)
- Audit ENABLE_REVERSE_PROXY_AUTHENTICATION and REVERSE_PROXY_TRUSTED_PROXIES settings; never leave trusted-proxies at the wildcard default when reverse-proxy authentication is enabled
- Review Gitea access and admin-action logs for unexpected X-WEBAUTH-USER headers or administrative actions not attributable to known administrators
- Restrict act_runner Docker-backend workflow execution to trusted users only and audit recent CI workflow definitions for container.options abuse (--pid=host, --cap-add, --security-opt)
Workarounds
- Explicitly set REVERSE_PROXY_TRUSTED_PROXIES to the actual proxy IP/CIDR instead of '*' if immediate upgrade is not possible
- Disable ENABLE_REVERSE_PROXY_AUTHENTICATION until patched if the true proxy address cannot be confirmed
- Set [service].REQUIRE_SIGNIN_VIEW=true as an interim mitigation for the container-registry exposure
Longer-term hardening
- Set [service].REQUIRE_SIGNIN_VIEW=true to require authentication for all content access, mitigating registry/package exposure issues
- Place self-hosted Gitea instances behind network segmentation and VPN access rather than direct internet exposure
- Adopt continuous dependency and vulnerability scanning to detect unreported/underground-leaked exploit code targeting self-hosted DevOps tooling
- Monitor dark-web and underground cybercrime forums via CTI feeds for resale of exploits targeting internal DevOps infrastructure
CVEs associated with Threat Actors Mass-Probe Gitea Docker Deployments for
CVE-2026-20896, CVE-2026-27771, CVE-2026-22874, CVE-2026-27775, CVE-2026-25038, CVE-2026-58053
Weaknesses (CWE) in Threat Actors Mass-Probe Gitea Docker Deployments for
CWE-290, CWE-807, CWE-284, CWE-918, CWE-863, CWE-200, CWE-269
Timeline of Threat Actors Mass-Probe Gitea Docker Deployments for
- NoScope's autonomous penetration-testing agent discovers CVE-2026-27771, an access-control failure in Gitea's built-in container registry that lets unauthenticated attackers pull private container images, and responsibly discloses it to the Gitea maintainer team (exact April 2026 date not publicly disclosed).
- Gitea 1.26.2 is released, fixing CVE-2026-27771 and crediting NoScope for the discovery.
- The Hacker News and SecurityWeek publicize CVE-2026-27771 (CVSS 8.2), reporting an estimated 30,000+ affected deployments across 30+ countries, exposed for close to four years.
- Gitea 1.26.3 is released, bundling fixes for CVE-2026-20896 (Docker reverse-proxy auth bypass), CVE-2026-22874 (SSRF in webhooks/migrations), CVE-2026-27775 (pre-receive hook privilege escalation), and CVE-2026-25038 (organization-label information disclosure).
- Multiple threat-intelligence sources report CVE-2026-20896 as confirmed actively exploited in the wild at the time of its public disclosure.
- Gitea 1.26.4 is released the same day to fix a repository code-page regression introduced in 1.26.3 while carrying forward the CVE-2026-20896 fix; 1.26.4 becomes the recommended update target.
- GitHub Security Advisory GHSA-f75j-4cw6-rmx4 is published (credited to researcher bircni), formally documenting CVE-2026-20896 - the REVERSE_PROXY_TRUSTED_PROXIES=* Docker default enabling X-WEBAUTH-USER admin impersonation - rated CVSS 9.8 Critical.
- Anonymous GitHub researcher 'bikini' publishes the 'Exploitarium' repository, releasing 130+ working proof-of-concept exploits across 22 open-source projects - including Gitea, libssh2, Splunk, RustDesk, 7-Zip, VLC, AnyDesk, OpenVPN, c-ares, and Floci - without prior vendor notification.
- CVE-2026-58053 is disclosed: a critical (CVSS 9.9) container-escape vulnerability in Gitea's act_runner CI/CD component via unsanitized container.options HostConfig fields (--pid=host, --cap-add, --security-opt), allowing escape to root on the host.
- The Register and other outlets cover the Exploitarium leak, broadening awareness of the public exploit cache among defenders and criminal actors alike.
- A threat actor advertises 'zero-day' exploits for Gitea, libssh, c-ares, and Floci on the darkforums.ru cybercrime forum, claiming exclusivity; analysis (femtosec) assesses this as resale of the already-public Exploitarium PoCs to underground buyers rather than genuine unreported zero-days.
- Analyst commentary continues to assess that because the CVE-2026-20896 bypass requires only a single crafted HTTP header, internet-wide automated scanners remain positioned to identify and weaponize exposed Gitea/Docker instances at scale; the specific July 2026 article that prompted this record could not be retrieved for verification (HTTP 403), so this record is grounded in the independently corroborated CVE-2026-20896 disclosure and exploitation reporting.
Sources cited for Threat Actors Mass-Probe Gitea Docker Deployments for
- One HTTP Header, Full Admin Access: Gitea's June 2026 Security Release Explained
- Gitea CVE-2026-20896 Auth Bypass Exploited via One HTTP Header
- Gitea Docker image: REVERSE_PROXY_TRUSTED_PROXIES = * default lets any source IP impersonate any user via X-WEBAUTH-USER (GHSA-f75j-4cw6-rmx4)
- Gitea 1.26.3 and 1.26.4 are released
- Gitea 1.26.2 is released
- Gitea Vulnerability Exposed 30,000 Deployments to Attacks
- Gitea Vulnerability Exposes Private Container Images without Authentication
- CVE-2026-27771: Gitea instances exposing private container images (NoScope disclosure)
- CVE-2026-27771: Gitea Registry Auth Bypass
- Gitea act_runner - Container Hardening Bypass via Workflow Container Options
- Gitea act_runner Docker Escape (CVE-2026-58053)
- Exploitarium Repository: Fake Zero-Day Claims Expose Real Risks
- Anonymous researcher drops 0-day 'exploitarium' repo
- Exploitarium: 130 0-Days Dropped-Two Are Critical Now
- bikini/exploitarium (GitHub repository, now removed)
Threats related to Threat Actors Mass-Probe Gitea Docker Deployments for
- Cryptojacking Campaign Exploiting Gogs (CVE-2026-52806) and Argo Workflows (CVE-2026-42296/CVE-2026-42295) Targets Managed Kubernetes Clusters
- Gitea Container Registry Authorization Bypass (CVE-2026-27771) — Unauthenticated Pull of Private Container Images Across 31,000+ Self-Hosted Instances
- JADEPUFFER: First End-to-End Agentic Ransomware Attack Exploiting Langflow (CVE-2025-3248) and Nacos (CVE-2021-29441)
- OpenAI Models Chain Eight JFrog Artifactory Zero-Days to Escape Sandbox and Breach Hugging Face
- P2Pinfect Kubernetes Compromise — Exposed Redis Enables Persistent GKE Botnet Enrollment with Six-Month Dormancy (CVE-2022-0543, CVE-2025-11953, CVE-2025-49844)
- Linux Kernel cgroups v1 release_agent Container Escape & Privilege Escalation (CVE-2022-0492) — Added to CISA KEV (Active Exploitation)
Detection coverage for TL-2026-1136
As of 2026-07-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1136 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.