Threat Actors Mass-Probe Gitea Docker Deployments for CVE-2026-20896 Authentication Bypass Amid Exploitarium Zero-Day Leak Wave

Threat Actors Mass-Probe Gitea Docker Deployments for (TL-2026-1136), also tracked as Gitea Docker Auth Bypass, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-07-06. It is attributed to Opportunistic Scanning Actors with low confidence, affects Gitea Gitea (official Docker image), references 6 CVEs (CVE-2026-20896, CVE-2026-27771, CVE-2026-22874), maps to 22 MITRE ATT&CK techniques (T1021, T1068, T1087), and is covered by 9 detection rules and 21 indicators of compromise.

Key facts for TL-2026-1136

Threat ID
TL-2026-1136
Also known as
Gitea Docker Auth Bypass, X-WEBAUTH-USER Bypass, Exploitarium Gitea Exploitation Wave
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-06
Last reviewed
2026-07-06
Attribution
Opportunistic Scanning Actors
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
technology, softwaredevelopment, health, aerospace, retail
Target regions
Global
Detection rules
9
Indicators of compromise
21

Malware and tooling in Threat Actors Mass-Probe Gitea Docker Deployments for

Malware and tooling: act_runner (act v0.262.0 dependency)

A cluster of critical Gitea vulnerabilities disclosed between May and June 2026 - led by CVE-2026-20896, a CVSS 9.8 Docker-image authentication bypass exploitable with a single X-WEBAUTH-USER HTTP header - is being actively probed and exploited following the anonymous 'Exploitarium' mass zero-day PoC dump and the subsequent resale of those exploits on the darkforums.ru cybercrime forum. Automated scanners can identify and weaponize exposed, unpatched self-hosted Gitea/Docker instances at internet scale with a single crafted request.

How Threat Actors Mass-Probe Gitea Docker Deployments for works

Gitea, a widely deployed self-hosted Git service, went through a sustained security crisis across Q2 2026 that produced a cluster of critical vulnerabilities now being actively probed by opportunistic threat actors. The centerpiece is CVE-2026-20896 (CVSS 9.8), disclosed via GitHub Security Advisory GHSA-f75j-4cw6-rmx4 on 2026-06-21 and credited to researcher 'bircni'. Gitea's official Docker images shipped with REVERSE_PROXY_TRUSTED_PROXIES set to '*' by default. When an administrator enables ENABLE_REVERSE_PROXY_AUTHENTICATION=true to front Gitea with an SSO-validating reverse proxy, Gitea is supposed to trust the X-WEBAUTH-USER identity header only from the proxy's own loopback connection. Because the Docker image's default trusted-proxies value was a wildcard, Gitea instead trusted X-WEBAUTH-USER from any source IP able to reach the container. The result: any HTTP client - an internal user, an external attacker who can reach the Gitea port, or an automated scanner - could send a single header, X-WEBAUTH-USER: admin, and receive full administrative control of the Git server, including every repository, embedded SSH keys, CI/CD pipeline definitions, and stored secrets, with zero authentication preconditions. CVE-2026-20896 was confirmed actively exploited in the wild at the time of its public disclosure, and because the exploit requires only a single crafted header, analysts assess that internet-wide automated scanning tools were positioned to identify and weaponize the flaw at scale for as long as the vulnerable default remained deployed. The fix (reverse-proxy authentication is now opt-in and admin-configured) shipped in Gitea 1.26.3 (2026-06-18) and was carried forward into 1.26.4 (2026-06-21), which is the recommended update target since 1.26.3 introduced an unrelated repository code-page regression. The same 1.26.3/1.26.4 release bundle also fixed three related issues: CVE-2026-22874 (an incomplete SSRF allow-list in webhooks and repository migrations that could reach internal addresses), CVE-2026-27775 (a pre-receive hook privilege-escalation bug where the first pushed ref's permission check was cached and reused for all subsequent refs, letting a per-branch maintainer-edit grant escalate to full repository write), and CVE-2026-25038 (an information-disclosure flaw where private organization labels leaked through label-read endpoints to non-members). This followed an earlier, independently disclosed Gitea flaw, CVE-2026-27771 (CVSS 8.2), an access-control failure in Gitea's built-in OCI container registry that let unauthenticated remote attackers pull images marked private without any credentials; discovered by NoScope's autonomous penetration-testing agent in April 2026, responsibly disclosed, fixed in Gitea 1.26.2 (2026-05-20), and publicized by The Hacker News and SecurityWeek in late May 2026 as affecting an estimated 30,000+ internet-facing deployments across 30+ countries, left exposed for close to four years. A third, separate critical flaw, CVE-2026-58053 (CVSS 9.9), was disclosed on 2026-06-28 in Gitea's act_runner CI/CD component: when act_runner uses the Docker backend, a workflow's container.options string is passed unsanitized into the job container's Docker HostConfig, so options such as --pid=host, --cap-add, and --security-opt survive even though the privileged flag itself is correctly disabled - allowing any user with workflow-definition privileges to escape the job container and obtain root on the host. The threat-actor angle driving active exploitation of this vulnerability cluster centers on the 'Exploitarium' incident: on 2026-06-23, an anonymous GitHub account using the handle 'bikini' published a now-removed repository containing 130+ working proof-of-concept exploits spanning 22 open-source projects - including Gitea, libssh2, Splunk, RustDesk, 7-Zip, VLC, AnyDesk, OpenVPN, c-ares, and Floci - without any prior vendor notification, explicitly inviting the security community to report the flaws and claim CVE credit. The dump included PoC material touching the Gitea Docker auth bypass as well as a separate, unrelated libssh2 pre-authentication heap-write RCE (CVE-2026-55200) that has also seen confirmed in-the-wild exploitation. The Register and multiple other outlets amplified awareness of the leak within days. Shortly after, a threat actor began advertising 'zero-day' exploits for Gitea, libssh, c-ares, and Floci on the darkforums.ru cybercrime forum, claiming exclusive, unpatched access; threat-intelligence analysis (femtosec) assesses this listing as an underground resale/relabeling of the already-public Exploitarium PoCs intended to defraud other criminal buyers, rather than genuine undisclosed zero-days - but the PoC code itself is fully functional and any actor, criminal or otherwise, can retrieve it directly from the public leak at no cost. This combination - a trivially exploitable, confirmed-active CVSS 9.8 authentication bypass, a public cache of working exploit code, and criminal marketplace amplification - is what is driving reported mass probing/scanning activity against internet-facing Gitea Docker deployments. Note on sourcing: the specific July 2026 news article that originally prompted this threat record could not be retrieved for direct verification after repeated attempts (HTTP 403 Forbidden on both direct fetch and an alternate fetch proxy), and no exact-match article could be located via search. This record is therefore grounded instead in the independently corroborated underlying CVE-2026-20896 disclosure, the related Gitea CVE cluster, and the Exploitarium/darkforums.ru exploitation context, all confirmed across multiple independent sources. Organizations running self-hosted Gitea via Docker should treat any internet-reachable instance running 1.26.2 or earlier as compromised-until-proven-otherwise and prioritize immediate patching and log review.

MITRE ATT&CK techniques used in TL-2026-1136

Lateral Movement

T1021 Remote Services; T1550 Use Alternate Authentication Material

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1611 Escape to Host

Discovery

T1087 Account Discovery; T1613 Container and Resource Discovery

Persistence

T1098 Account Manipulation; T1136 Create Account

Initial Access

T1190 Exploit Public-Facing Application; T1195 Supply Chain Compromise

Collection

T1213 Data from Information Repositories

Credential Access

T1528 Steal Application Access Token; T1552 Unsecured Credentials

defense-impairment

T1556 Modify Authentication Process

Impact

T1565 Data Manipulation

Exfiltration

T1567 Exfiltration Over Web Service

Resource Development

T1588 Obtain Capabilities; T1650 Acquire Access

Reconnaissance

T1595 Active Scanning; T1596 Search Open Technical Databases

Execution

T1609 Container Administration Command

execution

T1610 Deploy Container

Affected products and versions in Threat Actors Mass-Probe Gitea Docker Deployments for

  • Gitea — Gitea (official Docker image)
    Vulnerable versions: <=1.26.2 Docker images with default REVERSE_PROXY_TRUSTED_PROXIES=*
    Fixed in: 1.26.3; 1.26.4 (recommended)
  • Gitea — Gitea built-in container/OCI package registry
    Vulnerable versions: < 1.26.2
    Fixed in: 1.26.2
  • Gitea — act_runner (Gitea Actions CI/CD runner, Docker backend)
    Vulnerable versions: act dependency <=0.262.0
    Fixed in: patched release with container.options sanitization (CVE-2026-58053 fix)

Remediation for Threat Actors Mass-Probe Gitea Docker Deployments for

Patches

  • Gitea 1.26.2 (fixes CVE-2026-27771)
  • Gitea 1.26.3 (fixes CVE-2026-20896, CVE-2026-22874, CVE-2026-27775, CVE-2026-25038)
  • Gitea 1.26.4 (fixes 1.26.3 code-page regression; recommended update target)
  • act_runner/act patch addressing CVE-2026-58053 container.options sanitization

Immediate actions

  • Update all Gitea Docker deployments to 1.26.4 (do not stop at 1.26.3, which carries an unrelated repository code-page regression)
  • Audit ENABLE_REVERSE_PROXY_AUTHENTICATION and REVERSE_PROXY_TRUSTED_PROXIES settings; never leave trusted-proxies at the wildcard default when reverse-proxy authentication is enabled
  • Review Gitea access and admin-action logs for unexpected X-WEBAUTH-USER headers or administrative actions not attributable to known administrators
  • Restrict act_runner Docker-backend workflow execution to trusted users only and audit recent CI workflow definitions for container.options abuse (--pid=host, --cap-add, --security-opt)

Workarounds

  • Explicitly set REVERSE_PROXY_TRUSTED_PROXIES to the actual proxy IP/CIDR instead of '*' if immediate upgrade is not possible
  • Disable ENABLE_REVERSE_PROXY_AUTHENTICATION until patched if the true proxy address cannot be confirmed
  • Set [service].REQUIRE_SIGNIN_VIEW=true as an interim mitigation for the container-registry exposure

Longer-term hardening

  • Set [service].REQUIRE_SIGNIN_VIEW=true to require authentication for all content access, mitigating registry/package exposure issues
  • Place self-hosted Gitea instances behind network segmentation and VPN access rather than direct internet exposure
  • Adopt continuous dependency and vulnerability scanning to detect unreported/underground-leaked exploit code targeting self-hosted DevOps tooling
  • Monitor dark-web and underground cybercrime forums via CTI feeds for resale of exploits targeting internal DevOps infrastructure

CVEs associated with Threat Actors Mass-Probe Gitea Docker Deployments for

CVE-2026-20896, CVE-2026-27771, CVE-2026-22874, CVE-2026-27775, CVE-2026-25038, CVE-2026-58053

Weaknesses (CWE) in Threat Actors Mass-Probe Gitea Docker Deployments for

CWE-290, CWE-807, CWE-284, CWE-918, CWE-863, CWE-200, CWE-269

Timeline of Threat Actors Mass-Probe Gitea Docker Deployments for

  • NoScope's autonomous penetration-testing agent discovers CVE-2026-27771, an access-control failure in Gitea's built-in container registry that lets unauthenticated attackers pull private container images, and responsibly discloses it to the Gitea maintainer team (exact April 2026 date not publicly disclosed).
  • Gitea 1.26.2 is released, fixing CVE-2026-27771 and crediting NoScope for the discovery.
  • The Hacker News and SecurityWeek publicize CVE-2026-27771 (CVSS 8.2), reporting an estimated 30,000+ affected deployments across 30+ countries, exposed for close to four years.
  • Gitea 1.26.3 is released, bundling fixes for CVE-2026-20896 (Docker reverse-proxy auth bypass), CVE-2026-22874 (SSRF in webhooks/migrations), CVE-2026-27775 (pre-receive hook privilege escalation), and CVE-2026-25038 (organization-label information disclosure).
  • Multiple threat-intelligence sources report CVE-2026-20896 as confirmed actively exploited in the wild at the time of its public disclosure.
  • Gitea 1.26.4 is released the same day to fix a repository code-page regression introduced in 1.26.3 while carrying forward the CVE-2026-20896 fix; 1.26.4 becomes the recommended update target.
  • GitHub Security Advisory GHSA-f75j-4cw6-rmx4 is published (credited to researcher bircni), formally documenting CVE-2026-20896 - the REVERSE_PROXY_TRUSTED_PROXIES=* Docker default enabling X-WEBAUTH-USER admin impersonation - rated CVSS 9.8 Critical.
  • Anonymous GitHub researcher 'bikini' publishes the 'Exploitarium' repository, releasing 130+ working proof-of-concept exploits across 22 open-source projects - including Gitea, libssh2, Splunk, RustDesk, 7-Zip, VLC, AnyDesk, OpenVPN, c-ares, and Floci - without prior vendor notification.
  • CVE-2026-58053 is disclosed: a critical (CVSS 9.9) container-escape vulnerability in Gitea's act_runner CI/CD component via unsanitized container.options HostConfig fields (--pid=host, --cap-add, --security-opt), allowing escape to root on the host.
  • The Register and other outlets cover the Exploitarium leak, broadening awareness of the public exploit cache among defenders and criminal actors alike.
  • A threat actor advertises 'zero-day' exploits for Gitea, libssh, c-ares, and Floci on the darkforums.ru cybercrime forum, claiming exclusivity; analysis (femtosec) assesses this as resale of the already-public Exploitarium PoCs to underground buyers rather than genuine unreported zero-days.
  • Analyst commentary continues to assess that because the CVE-2026-20896 bypass requires only a single crafted HTTP header, internet-wide automated scanners remain positioned to identify and weaponize exposed Gitea/Docker instances at scale; the specific July 2026 article that prompted this record could not be retrieved for verification (HTTP 403), so this record is grounded in the independently corroborated CVE-2026-20896 disclosure and exploitation reporting.

Sources cited for Threat Actors Mass-Probe Gitea Docker Deployments for

Threats related to Threat Actors Mass-Probe Gitea Docker Deployments for

Detection coverage for TL-2026-1136

As of 2026-07-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1136 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats