Threat reportVulnerabilityTL-2026-4928
Exploitarium: Mass Public Disclosure of Unreported Zero-Day PoCs (libssh2 CVE-2026-55200, Gitea CVE-2026-20896 / CVE-2026-58053, 7-Zip, Docker, OpenVPN Connect, VLC, nmap)
Exploitarium (TL-2026-4928), also tracked as Exploitarium, is a high-severity software vulnerability, first published 2026-10-31. It has no confirmed attribution, affects libssh2 libssh2, references 3 CVEs (CVE-2026-55200, CVE-2026-58053, CVE-2026-20896), maps to 9 MITRE ATT&CK techniques (T1078, T1090, T1190), and is covered by 9 detection rules and 14 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 3Referenced vulnerabilities
- Techniques
- 9MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 14Indicators of compromise
Key facts for TL-2026-4928
- Threat ID
- TL-2026-4928
- Also known as
- Exploitarium, bikini/exploitarium
- Severity
- HIGH
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, software-development, government administration, finance, telecoms
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 14
Malware and tooling in Exploitarium
Malware and tooling: AnyDesk, RustDesk
How Exploitarium works
An anonymous researcher using the handle 'bikini' published 'Exploitarium', a GitHub archive of 130+ proof-of-concept exploits and write-ups that, per the author, had not been reported to vendors. Some findings later received CVEs (libssh2 CVE-2026-55200, Gitea act_runner CVE-2026-58053), and active exploitation was reported for the Gitea Docker authentication bypass CVE-2026-20896.
In late June 2026 an anonymous researcher using the handle 'bikini' published the GitHub repository 'bikini/exploitarium', described as 'a single archive of public exploit PoCs and vulnerability research writeups. At the time I post these, none have been reported.' The tl;dr sec #336 newsletter (2026-07-09) cites 130+ PoCs and write-ups targeting libssh2, Gitea, 7-Zip, Docker, OpenVPN Connect, VLC and nmap. The author invited others to report the issues and take CVE credit, and stated the material should not be abused ('I do this so to allure people into the field'). The Register (2026-06-29) reported that GitHub subsequently removed the repository.
Source counts differ. The Register and IT-Connect cite 15 affected products or projects. Hackmag lists 18 products (7-Zip, AnyDesk, curl, Docker, Firefox, FFmpeg, Ghidra, Gitea, Gogs, ImageMagick, libssh2, MyBB, Nmap, OpenVPN, PHP, QEMU, RustDesk, VLC), 31 PoC directories and 12 findings with assigned CVEs. VPNCentral reports 204 files across 35 projects. The repository snapshot reviewed showed 47+ folders and a consolidation of 12 former standalone repositories (96 tracked entries, verified 2026-06-23). Vulnerability classes include RCE, local privilege escalation, authentication bypass, out-of-bounds read/write, CSRF and chained exploits. Hackmag reports that the author used GPT-5.3 fuzzing with a 'strictly defined automated workflow'. The Register and IT-Connect instead cite GPT-5.5 Codex. Exploits were reportedly written manually, with AI assistance on RustDesk. Some community members dismissed parts of the dump as AI-generated noise.
CVE-2026-55200 (libssh2 <= 1.11.1): ssh2_transport_read() in transport.c does not enforce an upper bound on the SSH packet_length field (CWE-680). A crafted packet during the SSH handshake, before authentication, causes heap out-of-bounds write and potential RCE. NVD scoring is CVSS 3.1 8.1-8.3 and CVSS 4.0 9.2. Hackmag describes the PoC as an attacker-controlled server corrupting client memory. Fix commit 97acf3dfda80c91c3a8c9f2372546301d4a1a7a8 (PR #2052) is merged on the development branch. VulnCheck credits Tristan Madani as original discoverer, and the CVE was published 2026-06-17 before the PoC appeared in Exploitarium (reported 2026-06-23). Transitive consumers such as curl, Git and PHP link libssh2.
CVE-2026-58053 (Gitea act_runner <= 0.262.0, Docker backend): the runner passes a workflow's container.options to the Docker HostConfig, forcing only the Privileged flag off while merging options such as --pid=host, --cap-add and --security-opt unchanged. This lets an authenticated workflow author escape to host root (CVSS 4.0 9.4, CVSS 3.1 9.9, CWE-269). VulnCheck cites the bikini/exploitarium gitea-act-runner-container-options-poc directory as the public PoC.
CVE-2026-20896 (Gitea official Docker image <= 1.26.2): the image defaults to REVERSE_PROXY_TRUSTED_PROXIES=*, so any source IP can impersonate users via the X-WEBAUTH-USER header when reverse-proxy authentication is enabled (CVSS 9.8, CWE-284). It is fixed in 1.26.3, and 1.26.4 is recommended. BleepingComputer reports Sysdig observed in-the-wild exploitation (a VPN-exit scanner obtained access, first seen about 13 days after the advisory) and that Singapore CSA warned of active exploitation. About 6,200 Gitea instances were reported publicly exposed. Link to Exploitarium: Detections.ai and The Register's coverage tie this CVE to the same disclosure wave, but the Exploitarium README itself, as reviewed, does not confirm that CVE-2026-20896 originates from the archive.
Evidence caveats: The Register states two flaws (CVE-2026-55200 and CVE-2026-58053) showed evidence of real-world attacks, while IT-Connect and BleepingComputer point to the Gitea authentication bypass. Detections.ai asserts 'threat actors probing within days' and attributes activity to ShinyHunters. That attribution is not corroborated by any other source and is NOT adopted here, so the actor is recorded as Unknown. No network IOCs (IPs or domains) were published in the sources reviewed, so no BeaconBeagle correlation was applicable.
MITRE ATT&CK techniques used in TL-2026-4928
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Command and Control
Execution
T1203 Exploitation for Client Execution
Collection
T1213 Data from Information Repositories
Resource Development
T1587 Develop Capabilities; T1588 Obtain Capabilities
Reconnaissance
Privilege Escalation
Affected products and versions in Exploitarium
- libssh2 — libssh2
Vulnerable versions: <= 1.11.1 (commits before 97acf3d)
Fixed in: Fix commit 97acf3dfda80c91c3a8c9f2372546301d4a1a7a8; stable release pending - Gitea — Gitea official Docker image
Vulnerable versions: <= 1.26.2
Fixed in: 1.26.3; 1.26.4 - Gitea — act_runner (Docker backend)
Vulnerable versions: <= 0.262.0 - Various (unpatched at disclosure) — 7-Zip, Docker, OpenVPN Connect, VLC, nmap, Splunk, RustDesk, AnyDesk, c-ares, Gogs, Firefox, Redis, PostgreSQL, PHP, Nextcloud, curl, QEMU, Ghidra, ImageMagick (as named across sources)
Vulnerable versions: Per-PoC; not enumerated in sources
Remediation for Exploitarium
Patches
- Gitea 1.26.3 / 1.26.4 for CVE-2026-20896
- libssh2 fix commit 97acf3dfda80c91c3a8c9f2372546301d4a1a7a8 (PR #2052); stable release pending at time of reporting
- Gitea act_runner: fixed version not specified in the VulnCheck advisory; verify against upstream releases newer than 0.262.0
Immediate actions
- Upgrade Gitea Docker deployments to 1.26.4 (1.26.3 minimum) or set REVERSE_PROXY_TRUSTED_PROXIES to the specific IPs of your authenticating proxy instead of '*'
- Do not expose the Gitea container HTTP port directly; force all traffic through the authenticating reverse proxy and strip inbound X-WEBAUTH-USER headers at the edge
- Review Gitea access logs for requests carrying X-WEBAUTH-USER from non-proxy source IPs and audit admin account activity, tokens and repository secrets
- Inventory software that statically or dynamically links libssh2 (curl, Git, PHP and others) and track vendor patches for CVE-2026-55200
- Restrict who can author CI workflows on Gitea act_runner hosts and disallow container.options from untrusted repositories
Workarounds
- Disable reverse-proxy authentication (ENABLE_REVERSE_PROXY_AUTHENTICATION) if not required
- Avoid connecting libssh2-based clients to untrusted SSH servers until patched
- Run act_runner jobs without Docker socket access and with container options restricted by policy
Longer-term hardening
- Run CI runners on ephemeral, isolated hosts or rootless/sandboxed container runtimes
- Track newly published unreported PoC archives and add vendor-triage SLAs for open-source dependencies
- Deploy behavioral detection for container escape (--pid=host, --cap-add, --security-opt overrides) and anomalous SSH handshake packet lengths
CVEs associated with Exploitarium
Weaknesses (CWE) in Exploitarium
Timeline of Exploitarium
- Patch for the libssh2 packet_length flaw accepted upstream (per Hackmag); fix commit 97acf3d, PR #2052.
- CVE-2026-55200 (libssh2 <= 1.11.1 out-of-bounds write in ssh2_transport_read) published; VulnCheck credits Tristan Madani.
- Exploitarium repository consolidates 12 former standalone repos (96 tracked entries); Hackmag dates the libssh2 PoC appearing in the archive to this day.
- VulnCheck publishes advisory for CVE-2026-58053 (Gitea act_runner container hardening bypass) citing the Exploitarium PoC; NVD lists publication 2026-06-28.
- The Register reports the Exploitarium drop, no vendor notification, and that GitHub subsequently removed the repository.
- IT-Connect reports the disclosure across 15 open-source products including libssh2, Splunk, RustDesk, 7-Zip, VLC, AnyDesk, OpenVPN, c-ares, Gitea and Floci.
- CVE-2026-20896 (Gitea Docker image default REVERSE_PROXY_TRUSTED_PROXIES=*) published; fixed in Gitea 1.26.3 and later 1.26.4; Hackmag article published same day.
- tl;dr sec #336 cites the Exploitarium archive of 130+ PoCs for libssh2, Gitea, 7-Zip, Docker, OpenVPN Connect, VLC and nmap.
- Detections.ai publishes analysis and detection content (44 KQL rules per The Register) and reports probing activity after disclosure.
Sources cited for Exploitarium
- [tl;dr sec] #336 - Autonomous Vulnerability Hunting, GuardDog 3.0, Are Bug Bounties Cooked?
- bikini/exploitarium (GitHub)
- The Register - Anonymous researcher drops 0-day 'Exploitarium' repo
- Hackmag - Security Researcher Publishes Exploits for Dozens of 0-Day Vulnerabilities on Exploitarium
- Detections.ai - Exploitarium: Mass Disclosure of Zero-Day Proof-of-Concepts
- IT-Connect - Exploitarium: un chercheur dévoile des failles zero-day dans 15 logiciels open source
- NVD - CVE-2026-55200 (libssh2)
- VulnCheck - libssh2 out-of-bounds write via unchecked packet length in transport.c
- libssh2 PR #2052 (fix for CVE-2026-55200)
- NVD - CVE-2026-20896 (Gitea Docker image)
- Gitea security advisory GHSA-f75j-4cw6-rmx4
- Gitea blog - Release of 1.26.3 and 1.26.4
- BleepingComputer - Hackers exploit critical auth bypass in Gitea Docker image
- NVD - CVE-2026-58053 (Gitea act_runner)
- VulnCheck - Gitea act_runner container hardening bypass via workflow container options
Detection coverage for TL-2026-4928
As of 2026-10-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4928 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.