Early Probes Emerge Against Patched Gitea Docker Flaw CVE-2026-20896
Threat actors are probing a critical Gitea Docker vulnerability (CVE-2026-20896) that allowed unauthenticated users to impersonate others via the X-WEBAUTH-USER header when reverse-proxy trust was misconfigured; the weakness affected Gitea 1.26.2 and was fixed in 1.26.3 by removing the wildcard and requiring opt-in reverse-proxy authentication. Sysdig detected the first in-the-wild activity 13 days after disclosure across roughly 6,200 internet-facing instances; admins should patch promptly and review proxy settings.