{"vulnerability": "cve-2026-2089", "sightings": [{"uuid": "0f928ef3-9bcb-44a4-ae65-21675008467d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20895", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mg4kwxk5fd2l", "content": "", "creation_timestamp": "2026-03-03T01:00:14.693849Z"}, {"uuid": "a8b86aa0-6b92-47ec-8173-f70b5de1aca4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20895", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-04", "content": "", "creation_timestamp": "2026-02-26T11:00:00.000000Z"}, {"uuid": "3b084f68-5093-4a8b-a6d1-ad4b79b94949", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20893", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mbsrhqtnu62y", "content": "", "creation_timestamp": "2026-01-07T05:49:36.620530Z"}, {"uuid": "bc31a3d5-7063-48ee-bbec-63bf16e4716a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20893", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mbtjldpxrg2p", "content": "", "creation_timestamp": "2026-01-07T13:01:07.509011Z"}, {"uuid": "7aa235e5-5a4a-4c10-9821-d1e482a599a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-20892", "type": "seen", "source": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-006887.html", "content": "", "creation_timestamp": "2026-03-16T03:00:08.000000Z"}, {"uuid": "ab3de161-68fe-4e80-85aa-6a3031b62832", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20894", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mck2xngox22x", "content": "", "creation_timestamp": "2026-01-16T12:10:47.477093Z"}, {"uuid": "2859f7db-2e7d-4004-a973-c7a55b7e815d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20893", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mcofudmm522k", "content": "", "creation_timestamp": "2026-01-18T05:36:28.033854Z"}, {"uuid": "4a840d5d-08c3-4349-a036-0bbc7c214cd8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-20892", "type": "seen", "source": "https://jvn.jp/en/vu/JVNVU98103854/", "content": "", "creation_timestamp": "2026-03-11T05:00:00.000000Z"}, {"uuid": "2bace302-2827-45d6-a94f-e0182f9bc9bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20897", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3md2cw4foce2i", "content": "", "creation_timestamp": "2026-01-22T23:15:41.642334Z"}, {"uuid": "ee2f7d1e-5f39-4015-8133-92b11ac477f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20897", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3md4wuzfs3q22", "content": "", "creation_timestamp": "2026-01-24T00:18:20.121423Z"}, {"uuid": "ddf5b586-954b-47ce-97df-77b59ecc8ccd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20897", "type": "seen", "source": "https://gist.github.com/alon710/fd7a8ba187046b7eeda01ae43554e2fd", "content": "", "creation_timestamp": "2026-01-24T21:22:12.000000Z"}, {"uuid": "62813ac8-aa84-459e-b470-7221608a9c68", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-20896", "type": "seen", "source": "https://bsky.app/profile/thecybersecguru.com/post/3mp65jcs6sh27", "content": "Three Vulnerabilities, One Platform: Why Your Self-Hosted Gitea/Gogs Instance Is Probably Already\u00a0Owned\n\nThree critical Gitea and Gogs CVEs disclosed in 2026: a CVSS 9.8 auth bypass via X-WEBAUTH-USER header,\u2026\n\nhttps://thecybersecguru.com/news/cve-2026-20896-gitea-authentication-bypass-dom-xss-ssrf/", "creation_timestamp": "2026-06-26T04:52:06.315766Z"}, {"uuid": "fc8bee44-ecb4-4692-a320-a34f4b558312", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/shiojiri.com/post/3mpidt76pcsbr", "content": "\u533f\u540d\u306e\u7814\u7a76\u8005\u304c\u30bc\u30ed\u30c7\u30a4\u6570\u4ef6\u3092GitHub\u30ea\u30dd\u30b8\u30c8\u30ea\u3067\u516c\u958b\uff08CVE-2026-55200\u3001CVE-2026-20896\uff09 | Codebook\uff5cSecurity News https://codebook.machinarecord.com/threatreport/silobreaker-cyber-alert/46394/", "creation_timestamp": "2026-06-30T06:11:34.296661Z"}, {"uuid": "672973c2-2cc6-42ad-882c-039e474f5a47", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/potato.software/post/3mpidta6bgb2n", "content": "\u533f\u540d\u306e\u7814\u7a76\u8005\u304c\u30bc\u30ed\u30c7\u30a4\u6570\u4ef6\u3092GitHub\u30ea\u30dd\u30b8\u30c8\u30ea\u3067\u516c\u958b\uff08CVE-2026-55200\u3001CVE-2026-20896\uff09 | Codebook\uff5cSecurity News https://codebook.machinarecord.com/threatreport/silobreaker-potato-alert/46394/", "creation_timestamp": "2026-06-30T06:11:36.036527Z"}, {"uuid": "c068d707-8172-41f5-9b49-d04721662b22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mprkvjpwpw2x", "content": "CVE-2026-20896 - gitea open source git server\nGitea's Docker image has a security setting that allows anyone to pretend to be a user when using certain reverse-proxy authentication headers. This is a concern because it\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#gitea #CVE #infosec", "creation_timestamp": "2026-07-03T22:12:05.560700Z"}, {"uuid": "4a3f4580-eddd-4df0-9f29-1c8d4e7238d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mpv7wdllhg2p", "content": "CVE-2026-20896 - Critical auth bypass in Gitea Docker images \u22641.26.2. Default REVERSE_PROXY_TRUSTED_PROXIES=* allows IP spoofing via X-WEBAUTH-USER headers. CVSS 9.8. No patch available. Update config now. #CVE #Gitea #infosec\n\nhttps://www.valtersit.com/cve/CVE-2026-20896/", "creation_timestamp": "2026-07-05T09:06:20.854926Z"}, {"uuid": "ca843669-58f4-4ca7-9201-8299e4fc9abe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mpwhtesstw2e", "content": "\ud83d\udd34 CVE-2026-20896 - Critical (9.8)\n\nGitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by def...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-20896/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-05T21:00:31.349197Z"}, {"uuid": "f599afe7-03ef-42b4-a6a5-fb45c4ec88d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mpym3e6xsa2p", "content": "Threat actors attempt to exploit CVE-2026-20896 in Gitea Docker images by abusing trusted reverse-proxy authentication via the X-WEBAUTH-USER header.\n", "creation_timestamp": "2026-07-06T17:21:53.550435Z"}, {"uuid": "71ae1653-92fb-4fd9-9a3d-46be2804dba8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/hapsis.bsky.social/post/3mpyquy64dk2n", "content": "Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure\n\nthehackernews.com/2026/07/thre...\n\n#Cybersecurity #ThreatIntel #Vulnerability", "creation_timestamp": "2026-07-06T18:48:11.058488Z"}, {"uuid": "69d0eb7e-5e88-4822-8694-43cec8625307", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mpyjmjuh2f24", "content": "Threat actors probe Gitea Docker flaw CVE-2026-20896; update to version 1.26.3 immediately. #Gitea #Docker #CVE202620896 #CyberSecurity #DevOps #ContainerSecurity #Sysdig thedailytechfeed.com/threat-actor...", "creation_timestamp": "2026-07-06T16:37:48.940283Z"}, {"uuid": "77936aba-b592-470f-b3d0-d8ee5d3eafa8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/happeningnow.news/post/3mpymmfpqcp2s", "content": "Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure\nThreat actors have been observed attempting to exploit a recently patched critical security flaw in Gitea Docker images, according to Sysdig. The vulnerability in question is\u2026\n\n\ud83d\udd17 https://hnow.live/a/54e7dfd1", "creation_timestamp": "2026-07-06T17:31:26.339917Z"}, {"uuid": "0c39f5d1-fc43-4495-913d-10a503439e4c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mpynfgf3qn2w", "content": "Threat actors are probing Gitea Docker CVE-2026-20896, where trusted X-WEBAUTH-USER headers could enable user impersonation. Affects images through 1.26.2; fixed in 1.26.3. #Gitea #CVE-2026-20896 #Sysdig", "creation_timestamp": "2026-07-06T17:45:25.477030Z"}, {"uuid": "8dbb2c57-3add-4c81-a466-bf3a48e85381", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mpynjni2522p", "content": "CVE-2026-20896: Threat Actors Probing Gitea Docker Flaw Just 13 Days Post-Disclosure #CVE #Gitea #Docker", "creation_timestamp": "2026-07-06T17:47:46.826896Z"}, {"uuid": "81621d94-49ea-4b04-84fd-d4c1a8c78f9e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mpynjscrlz2v", "content": "CVE-2026-20896: Gitea's Critical Docker Flaw Ignites Immediate Attacker Interest #CVE202620896 #Gitea #Docker", "creation_timestamp": "2026-07-06T17:47:51.999147Z"}, {"uuid": "de01c308-d3bf-4c7b-b904-595ee9f6b0fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mpynjw3voa26", "content": "CVE-2026-20896: Quick Probes on Gitea Docker Flaw Raise Alarms #CVE2026 #Gitea #DockerSecurity", "creation_timestamp": "2026-07-06T17:47:55.730040Z"}, {"uuid": "51c2c8d5-548c-45ec-aa3f-42391f54e4a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mpynjzcgtb2v", "content": "CVE-2026-20896: Gitea Docker's Flawed Trust Model Exposes Users to Attacks #CVE202620896 #Gitea #DockerSecurity", "creation_timestamp": "2026-07-06T17:47:59.446838Z"}, {"uuid": "2856693d-163a-4f6f-9921-79903909f8ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mpynocazyj2v", "content": "CVE-2026-20896: Attackers Probing Gitea Docker Flaw Raising Eyebrows #CyberSecurity #CVE2026 #Gitea", "creation_timestamp": "2026-07-06T17:50:23.453041Z"}, {"uuid": "84782018-f928-4998-8a36-765624c27819", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mpynofl34f2k", "content": "CVE-2026-20896: Are Threat Actors Exploiting Gitea Flaws Too Soon? #CVE202620896 #GiteaSecurity #ThreatActors", "creation_timestamp": "2026-07-06T17:50:26.511200Z"}, {"uuid": "e205fcc4-3389-4c69-b45d-bebf48c37fad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/cybersecurity0001.bsky.social/post/3mpynoifcex2v", "content": "Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure", "creation_timestamp": "2026-07-06T17:50:29.501152Z"}, {"uuid": "7c1446c0-6b50-46f1-8410-31bee4a6ae60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mpyowhw5i32x", "content": "Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure", "creation_timestamp": "2026-07-06T18:12:50.833036Z"}, {"uuid": "e89b442e-1e5f-4538-8224-70fb6e494caa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mpyqphtlhf2i", "content": "Gitea's official Docker image trusts the X-WEBAUTH-USER login header from any IP, so with reverse-proxy auth on, anyone reachable can log in as any user, no password.\n\nAffects images through 1.26.2. Fix: upgrade to 1.26.3. (CVE-2026-20896)", "creation_timestamp": "2026-07-06T18:44:43.380456Z"}, {"uuid": "b773791e-44e3-496f-818f-552c3a53527d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://thehackernews.com/2026/07/threat-actors-probe-gitea-docker-flaw.html", "content": "Threat actors have been observed attempting to exploit a recently patched critical security flaw in Gitea Docker images, according to Sysdig.\n\nThe vulnerability in question is CVE-2026-20896 (CVSS score: 9.8), a vulnerability that stems from the DevOps platform trusting the \"X-WEBAUTH-USER\" header from any source IP address, effectively allowing an unauthenticated internet client to get elevated", "creation_timestamp": "2026-07-06T19:00:42.499529Z"}, {"uuid": "03023146-be47-4246-bdf3-fd4a02659e29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-20896", "type": "seen", "source": "https://bsky.app/profile/blindthoughts.bsky.social/post/3mpyvtlmep32k", "content": "Active Exploitation: Patch CVE-2026-20896 in Gitea Docker Now (CVSS 9.8)\n\nhttps://blindthoughts.com/cve-2026-20896-gitea-docker-active-exploitation\n\n#vulnerability #gitea #docker #cve #activeexploitation", "creation_timestamp": "2026-07-06T20:16:29.915258Z"}, {"uuid": "793f96a2-2a7c-4386-ab8a-00fc63042ca8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mpyyqnac3b2j", "content": "\ud83e\udd16 CVE-2026-20896 (CVSS 9.8): Critical Gitea Docker flaw \u2014 unauthenticated RCE via X-WEBAUTH-USER header spoofing. Active exploitation detected.\n\nhttps://thehackernews.com/2026/07/threat-actors-probe-gitea-docker-flaw.html", "creation_timestamp": "2026-07-06T21:08:32.065365Z"}, {"uuid": "5c53ee2a-dc3c-45fb-a90c-37c2fe9d82dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/sleepydogtsjp.bsky.social/post/3mpz2kitryc2r", "content": "Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure\nthehackernews.com/2026/07/thre...", "creation_timestamp": "2026-07-06T21:40:55.805381Z"}, {"uuid": "479f1e17-4c9f-4a4b-bf6c-1ebddbb13dee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mpz4ri2krg2b", "content": "\u8105\u5a01\u30a2\u30af\u30bf\u30fc\u304cGitea\u306eDocker\u8106\u5f31\u6027CVE-2026-20896\u3092\u8abf\u67fb\uff08\u516c\u958b\u304b\u308913\u65e5\u5f8c\uff09 \n\nThreat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure  #HackerNews (Jul 6)\n\nthehackernews.com/2026/07/thre...", "creation_timestamp": "2026-07-06T22:20:36.242482Z"}, {"uuid": "53b1c07f-c037-4bc5-9e60-10dbd0b30767", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/crustytldr.bsky.social/post/3mpz3q4byjv2l", "content": "\ud83d\udcf0 Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure\n\nThreat actors have been observed attempting to exploit a recently patched critical security flaw in Gitea Docker i...\n\nhttps://tinyurl.com/2demjwlz #TechNews #CrustyTLDR", "creation_timestamp": "2026-07-06T22:01:55.624608Z"}, {"uuid": "dbafe40f-a96f-4d80-81df-4189c9b6c725", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/iberianm.bsky.social/post/3mpzpr7kl4q2m", "content": "Gitea Docker flaw CVE-2026-20896: attackers probe the patched issue quickly. Defenders should upgrade Gitea images to the fixed version and verify X-WEBAUTH handling. #Cybersecurity #Vulnerability #ThreatIntel\n\nSource: https://thehackernews.com/2026/07/threat-actors-probe-gitea-docker-flaw.html", "creation_timestamp": "2026-07-07T04:00:27.815740Z"}, {"uuid": "edc88acb-c4b1-4793-8ca2-9c6b63781557", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://thehackernews.com/2026/07/threat-actors-probe-gitea-docker-flaw.html", "content": "Threat actors have been observed attempting to exploit a recently patched critical security flaw in Gitea Docker images, according to Sysdig.\n\nThe vulnerability in question is CVE-2026-20896 (CVSS score: 9.8), a vulnerability that stems from the DevOps platform trusting the \"X-WEBAUTH-USER\" header from any source IP address, effectively allowing an unauthenticated internet client to get elevated", "creation_timestamp": "2026-07-07T01:00:43.011535Z"}, {"uuid": "1bc2b1c3-4021-48c1-81f4-1f5925d95b45", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/ninjaowl.ai/post/3mpzou6injh2q", "content": "Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure #cybersecurity #hacking #news #infosec #security #technology #privacy thehackernews.com/20...", "creation_timestamp": "2026-07-07T03:44:13.678490Z"}, {"uuid": "3193eb4a-e861-4e49-8dba-6e8ad0542c47", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/reconbee.bsky.social/post/3mq2qiha23s25", "content": "Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure reconbee.com/threat-actor...\n\n#cyberthreats #Giteadockerflaw #probe #cybersecurity #cyberattack", "creation_timestamp": "2026-07-07T13:46:10.900691Z"}, {"uuid": "9e3c79cd-e3d2-4ffc-92eb-c3801c5cf498", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mq34u5qnff2h", "content": "Gitea\u306e\u91cd\u5927\u306a\u8106\u5f31\u6027\u3001\u5b9f\u969b\u306b\u60aa\u7528\u304c\u78ba\u8a8d\u3055\u308c\u308b\u2015\u2015\u7814\u7a76\u8005\u3089\u304c\u8b66\u544a\n\n\u8105\u5a01\u30a2\u30af\u30bf\u30fc\u3089\u306f\u3001Gitea\u306e\u30ea\u30d0\u30fc\u30b9\u30d7\u30ed\u30ad\u30b7\u8a8d\u8a3c\u6a5f\u69cb\u306b\u5b58\u5728\u3059\u308b\u8106\u5f31\u6027\u3092\u60aa\u7528\u3057\u3001\u6709\u52b9\u306a\u30e6\u30fc\u30b6\u30fc\u540d\u3092\u4e00\u3064\u6307\u5b9a\u3059\u308b\u3060\u3051\u3067\u3001\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8\u304b\u3089\u30a2\u30af\u30bb\u30b9\u53ef\u80fd\u306a\u30a4\u30f3\u30b9\u30bf\u30f3\u30b9\u306b\u4fb5\u5165\u3057\u3066\u3044\u307e\u3059\u3002 \u3053\u306e\u91cd\u5927\u306a\u8106\u5f31\u6027\u306fGitea\u306e\u516c\u5f0fDocker\u30a4\u30e1\u30fc\u30b8\u306b\u56fa\u6709\u306e\u3082\u306e\u3067\u3001CVE-2026-20896\uff08CVSS\u30b9\u30b3\u30a29.8\uff09\u3068\u3057\u3066\u8ffd\u8de1\u3055\u308c", "creation_timestamp": "2026-07-07T17:27:24.624022Z"}, {"uuid": "d6b43c8e-e4e1-4963-9c3c-4c189ad75d00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/116879910895582885", "content": "\ud83d\udea8 Critical Gitea flaw CVE-2026-20896 is being probed in the wild\nResearchers warn that attackers are targeting a critical Gitea Docker image flaw that can allow authentication bypass with a single HTTP header.\nThe issue affects official Gitea Docker images up to 1.26.2 when reverse-proxy authentication is enabled.\nThe vulnerable default trusted any source IP as a reverse proxy, meaning an attacker who could reach the container\u2019s HTTP port could spoof X-WEBAUTH-USER and impersonate a known or guessable user.\nGitea patched the issue in 1.26.3 / 1.26.4, and a public PoC/checker is now available.\nSysdig says the first in-the-wild probing was seen 13 days after disclosure.\nObserved IP: 159[.]26[.]98[.]241", "creation_timestamp": "2026-07-07T17:38:26.634669Z"}, {"uuid": "c2729baf-f62b-4f67-a0dd-d988d6ea66d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mq35lpurkk2a", "content": "Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure\n\nThreat actors have been observed attempting to exploit a recently patched critical security flaw in Gitea Docker images, according to Sysdig.\n\nThe vulnerability in question is CVE-2026-20896 (CVSS score\u2026\n#hackernews #news", "creation_timestamp": "2026-07-07T17:40:35.826520Z"}, {"uuid": "fe3e7441-4c6e-40a9-80ce-ab87a2dbf6e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mq3gkwd45g2c", "content": "CVE-2026-20896: Gitea's Critical Flaw Exposes 6,200 Instances to Compromise #Gitea #CVE2026 #CyberSecurity", "creation_timestamp": "2026-07-07T20:21:12.968218Z"}, {"uuid": "791859c9-90c6-454f-a412-945a966f25d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mq3gl63xzu2p", "content": "CVE-2026-20896: Gitea's Critical Flaw Demands Urgent Action from Users #CVE2026 #Gitea #CyberSecurity", "creation_timestamp": "2026-07-07T20:21:24.576939Z"}, {"uuid": "eb4e7947-3db2-4ddb-81d6-0ee5bce10dfc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mq3glbti7d26", "content": "CVE-2026-20896: Gitea\u2019s Worrying Flaw Exposes Repositories to Attackers #CVE2026 #Gitea #CyberSecurity", "creation_timestamp": "2026-07-07T20:21:26.120991Z"}, {"uuid": "167612d7-fbc9-4b4a-b58c-e636de1277d9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mq3glfiwzg2c", "content": "CVE-2026-20896: Gitea's Critical Flaw Exposes Serious Governance Failures #CVE2026 #Gitea #Cybersecurity", "creation_timestamp": "2026-07-07T20:21:28.432106Z"}, {"uuid": "1acdf224-80db-408a-acb4-db09258a3082", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mq3gljudwf2g", "content": "CVE-2026-20896: Gitea's Critical Flaw Shows Our Fragile Patch Culture #CVE202620896 #Gitea #Cybersecurity", "creation_timestamp": "2026-07-07T20:21:33.210293Z"}, {"uuid": "e48ed6b3-9208-4734-b3c0-c0830c91fc9b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mq3glndvbs25", "content": "CVE-2026-20896: Critical Gitea Vulnerability \u2014 Urgent Response or Overblown Risk? #CyberSecurity #Vulnerability #Gitea", "creation_timestamp": "2026-07-07T20:21:36.709508Z"}, {"uuid": "a756ef80-6338-453c-98b7-ed54a36987a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/poxek.bsky.social/post/3mq3imnlegs2x", "content": "CVE-2026-20896 is a nasty Gitea Docker auth bypass: if reverse-proxy auth is enabled and the backend port is reachable, one HTTP header can impersonate a known user.\n\nX-WEBAUTH-USER: admin", "creation_timestamp": "2026-07-07T20:58:04.131298Z"}, {"uuid": "21f036c0-6555-4298-a3db-3ff3919d321e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/poxek.bsky.social/post/3mq3imnljd22x", "content": "CVE-2026-20896 is a nasty Gitea Docker auth bypass: if reverse-proxy auth is enabled and the backend port is reachable, one HTTP header can impersonate a known user.\n\nX-WEBAUTH-USER: admin", "creation_timestamp": "2026-07-07T20:58:05.475381Z"}, {"uuid": "3363e87e-724f-4a04-849b-e275e3db98c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/poxek.bsky.social/post/3mq3imnljd32x", "content": "CVE-2026-20896 is a nasty Gitea Docker auth bypass: if reverse-proxy auth is enabled and the backend port is reachable, one HTTP header can impersonate a known user.\n\nX-WEBAUTH-USER: admin", "creation_timestamp": "2026-07-07T20:58:06.828776Z"}, {"uuid": "5f4d49c9-9cde-4525-9a5c-4221e57d93b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/poxek.bsky.social/post/3mq3imnlkcd2x", "content": "CVE-2026-20896 is a nasty Gitea Docker auth bypass: if reverse-proxy auth is enabled and the backend port is reachable, one HTTP header can impersonate a known user.\n\nX-WEBAUTH-USER: admin", "creation_timestamp": "2026-07-07T20:58:08.214679Z"}, {"uuid": "0ac63e86-42e3-4204-a666-46bcd4067a08", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/poxek.bsky.social/post/3mq3imnlkce2x", "content": "CVE-2026-20896 is a nasty Gitea Docker auth bypass: if reverse-proxy auth is enabled and the backend port is reachable, one HTTP header can impersonate a known user.\n\nX-WEBAUTH-USER: admin", "creation_timestamp": "2026-07-07T20:58:09.852516Z"}, {"uuid": "f8df06a2-9388-4eac-8252-f3ebfd4c08ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/poxek.bsky.social/post/3mq3imox2uv2x", "content": "CVE-2026-20896 is a nasty Gitea Docker auth bypass: if reverse-proxy auth is enabled and the backend port is reachable, one HTTP header can impersonate a known user.\n\nX-WEBAUTH-USER: admin", "creation_timestamp": "2026-07-07T20:58:12.608226Z"}, {"uuid": "21c20d0b-30a1-402a-84d8-0e174d82f320", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/poxek.bsky.social/post/3mq3imox2uu2x", "content": "CVE-2026-20896 is a nasty Gitea Docker auth bypass: if reverse-proxy auth is enabled and the backend port is reachable, one HTTP header can impersonate a known user.\n\nX-WEBAUTH-USER: admin", "creation_timestamp": "2026-07-07T20:58:11.251158Z"}, {"uuid": "71857771-f9e0-4594-a1fd-873a87deff49", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/poxek.bsky.social/post/3mq3imox2uw2x", "content": "CVE-2026-20896 is a nasty Gitea Docker auth bypass: if reverse-proxy auth is enabled and the backend port is reachable, one HTTP header can impersonate a known user.\n\nX-WEBAUTH-USER: admin", "creation_timestamp": "2026-07-07T20:58:13.971632Z"}, {"uuid": "8f23c26e-0bb9-414f-bfd2-d9966088a489", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mq3jlslaca27", "content": "Active exploitation of CVE-2026-20896 lets attackers bypass Gitea auth with a valid username and one HTTP header, risking repo, secret, and CI/CD takeover. Update Docker images to 1.26.3. #Gitea #CVE202620896 #DevSecOps", "creation_timestamp": "2026-07-07T21:15:23.659334Z"}, {"uuid": "cd70650b-5da5-40f3-901d-a167591fab03", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mq3qfqngqi2f", "content": "CVE-2026-20896: Gitea's Docker Vulnerability Is a Recipe for Disaster #CyberSecurity #Vulnerability #Gitea", "creation_timestamp": "2026-07-07T23:17:16.565066Z"}, {"uuid": "7cd607fc-238e-4de7-81d1-26b96d651323", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mq3qfup33j27", "content": "CVE-2026-20896 Exposes Gitea Docker Repositories: Attackers Seizing Control #CVE202620896 #Gitea #Docker", "creation_timestamp": "2026-07-07T23:17:20.610586Z"}, {"uuid": "2046edb5-404c-4b30-a99d-46aa349614cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mq3qfzzak324", "content": "CVE-2026-20896: Gitea's Bug Exposes Repositories, Demands Urgent Attention #CVE202620896 #Gitea #CyberSecurity", "creation_timestamp": "2026-07-07T23:17:26.143975Z"}, {"uuid": "07ee9327-d719-4e23-b60d-d795b1154e67", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mq3qg6wsf32s", "content": "CVE-2026-20896: Gitea's Docker Flaw Exposes Critical Repositories Due to Configuration Failures #CVE202620896 #Gitea #Docker", "creation_timestamp": "2026-07-07T23:17:31.448100Z"}, {"uuid": "88bc5b1c-e5b3-4098-b23f-d4f43fc827a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mq3qgcu54z27", "content": "CVE-2026-20896: Gitea's Docker Flaw Exposes Repositories\u2014Is Anyone Paying Attention? #CVE202620896 #Gitea #Docker", "creation_timestamp": "2026-07-07T23:17:35.908797Z"}, {"uuid": "e81ca082-bee8-4328-b9bc-c1b0711d1b2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mq3qggs4ez27", "content": "CVE-2026-20896: Is Gitea's Critical Docker Vulnerability a Policy Failure? #CyberSecurity #Vulnerability #Gitea", "creation_timestamp": "2026-07-07T23:17:39.541976Z"}, {"uuid": "b1c1c27d-f48b-4f3f-ade3-fb9d51f53c40", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/technology-news.bsky.social/post/3mq474jhpg62i", "content": "CVE-2026-20896 lets reachable Gitea Docker containers trust spoofed X-WEBAUTH-USER headers when reverse proxy auth is enabled.", "creation_timestamp": "2026-07-08T03:40:32.735696Z"}, {"uuid": "1b352c32-b1f7-4695-be14-6183dfe490a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116882828726974974", "content": "CRITICAL: Gitea Docker (<1.26.3) is vulnerable to auth bypass (CVE-2026-20896) \u2014 attackers can access repos & secrets by spoofing a username header. Actively exploited! Patch to 1.26.3+ & restrict access now. https://radar.offseq.com/threat/critical-gitea-flaw-under-active-exploitation-rese-c58d67a324be5e40 #OffSeq #Gitea #Vuln #Infosec", "creation_timestamp": "2026-07-08T06:00:29.500188Z"}, {"uuid": "4f81d109-520e-4bd3-9a3d-6b14e87b41c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mq4gwsq67v2t", "content": "Gitea Docker (<1.26.3) hit by CRITICAL CVE-2026-20896. Auth bypass flaw is being exploited to access private code & secrets. Update to 1.26.3+ or restrict access immediately. https://radar.offseq.com/threat/critical-gitea-flaw-under-active-exploitation-rese-c58d67a324be5e40 #OffSeq #Gitea #Security", "creation_timestamp": "2026-07-08T06:00:31.269498Z"}, {"uuid": "a7f12491-0a62-4818-85e9-dfe624e5fc59", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/116884921124621905", "content": "\ud83d\udcf0 Critical Gitea Docker Flaw Actively Exploited for Unauthorized Access\n\ud83d\udd25 CRITICAL Gitea flaw (CVE-2026-20896, CVSS 9.8) is actively exploited! Insecure default in Docker images allows unauthenticated attackers to become admin. Update immediately or harden your proxy config! #Gitea #Vulnerability #DevSecOps\n\ud83c\udf10 cyber[.]netsecops[.]io\n\ud83d\udd17 https://cyber.netsecops.io/articles/critical-gitea-docker-flaw-actively-exploited-for-unauthorized-access/?utm_source=mastodon&utm_me\u2026", "creation_timestamp": "2026-07-08T14:52:36.954704Z"}, {"uuid": "f981045a-8a1e-4449-8109-e646d1dd48a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mq5epgvmwq2f", "content": "\ud83d\udd25 CRITICAL Gitea flaw (CVE-2026-20896, CVSS 9.8) is actively exploited! Insecure default in Docker images allows unauthenticated attackers to become admin. Update immediately or harden your proxy config! #Gitea #Vulnerability #DevSecOps\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-07-08T14:53:16.317267Z"}, {"uuid": "e8089181-a13d-4635-86e3-b334553cb6d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mq5yvuqybs2a", "content": "Critical Gitea Docker Bug Under Active Exploitation Exposes Repositories and Secrets\n\nAttackers are exploiting a critical Gitea flaw (CVE-2026-20896) that bypasses authentication with a single HTTP header, exposing repositories and sensitive data. Sysdig researchers warn that atta\u2026\n#hackernews #news", "creation_timestamp": "2026-07-08T20:54:47.476021Z"}, {"uuid": "f44ef31d-4708-4f53-99a0-811b77f4b620", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/eurotrends24.bsky.social/post/3mqbi56e2le2s", "content": "Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure", "creation_timestamp": "2026-07-10T06:05:16.978837Z"}, {"uuid": "02037afa-b7fd-44c8-902a-ffe78f37ba23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mqd25s3lhv2w", "content": "Hackers are exploiting CVE-2026-20896 in Gitea's Docker image, allowing auth bypass and user impersonation, including admins. The flaw affects default setups via reverse-proxy headers. #Gitea #Singapore #CVE2026", "creation_timestamp": "2026-07-10T21:00:25.133839Z"}, {"uuid": "dccbaf2a-596a-48dc-b5ae-3556186278e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mqds5kboup2q", "content": "\ud83e\udd16 CVE-2026-20896: Gitea Docker auth bypass actively exploited. Attackers impersonate any user including admins. Docker image trusted identity headers from any IP. Patch available.\nhttps://www.bleepingcomputer.com/news/security/hackers-exploit-critical-auth-bypass-in-gitea-docker-image/", "creation_timestamp": "2026-07-11T04:09:46.313704Z"}, {"uuid": "64740c48-49e0-417d-9d77-a4899e0cb906", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/blog.bubam.de/post/3mqdx3jldde22", "content": "Ein HTTP-Header gen\u00fcgt: Gitea-L\u00fccke CVE-2026-20896 (CVSS 9.8), aktiv ausgenutzt. Ich betreibe selbst eine Instanz \u2014 gepr\u00fcft, geh\u00e4rtet, aktualisiert. Und: \u201enicht erreichbar\" pr\u00fcft man von au\u00dfen, nicht im Config-File.\n\nhttps://blog.bubam.de/2026-07-11_gitea-ein-header-genuegt.html?s=bs", "creation_timestamp": "2026-07-11T05:38:07.342402Z"}, {"uuid": "1ac9aa24-c0db-4fff-b2c5-94bcbc6da5c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/eyalestrin.bsky.social/post/3mqebg4vrz62a", "content": "Urgent Action Required Gitea Docker Authentication Bypass (CVE-2026-20896 and CVE-2026-27771) #patchmanagement", "creation_timestamp": "2026-07-11T08:43:00.334770Z"}, {"uuid": "5e0acb44-ec18-4d0c-abba-9a097da920bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-20896", "type": "seen", "source": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mqeoqctp2g2s", "content": "\ud83d\udcf0 Peretas Aktif Mengeksploitasi Celah Kritis pada Docker Image Gitea, Bisa Login Sebagai Administrator\n\n\ud83d\udc49 Baca artikel lengkap di sini: https://ahmandonk.com/2026/07/11/kerentanan-gitea-docker-cve-2026-20896/\n\n#authenticationBypass #ci/cd #cve-2026-20896 #cyberSecurity #devops #docker #git #gi", "creation_timestamp": "2026-07-11T12:41:21.516481Z"}, {"uuid": "86aeec4b-d493-40fa-a8c1-6dc853d8491b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/116907370041051552", "content": "\ud83d\udcf0 Critical Gitea Docker Flaw Actively Exploited for Unauthorized Access\n\ud83d\udd25 CRITICAL Gitea flaw (CVE-2026-20896, CVSS 9.8) is actively exploited! Insecure default in Docker images allows unauthenticated attackers to become admin. Update immediately or harden your proxy config! #Gitea #Vulnerability #DevSecOps\n\ud83c\udf10 cyber[.]netsecops[.]io\n\ud83d\udd17 https://cyber.netsecops.io/articles/critical-gitea-docker-flaw-actively-exploited-for-unauthorized-access/?utm_source=mastodon&utm_me\u2026", "creation_timestamp": "2026-07-12T14:01:40.179846Z"}, {"uuid": "055bbba1-dfdb-4afd-b531-2a3f1c9b5851", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mqhdqcdr762h", "content": "\ud83d\udd25 CRITICAL Gitea flaw (CVE-2026-20896, CVSS 9.8) is actively exploited! Insecure default in Docker images allows unauthenticated attackers to become admin. Update immediately or harden your proxy config! #Gitea #Vulnerability #DevSecOps\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-07-12T14:02:28.137268Z"}, {"uuid": "2cb99295-c455-4aff-b2ae-aff16361266e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/technoholic.bsky.social/post/3mqhina72qx2p", "content": "Threat actors target a recent critical flaw in Gitea Docker images (CVE-2026-20896, CVSS 9.8). The bug allows unauthenticated clients to elevate privileges via the X-WEBAUTH-USER header.", "creation_timestamp": "2026-07-12T15:30:14.161615Z"}, {"uuid": "27f7e3bb-274b-4e9c-88e7-71c5e84604eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/aegisbot.bsky.social/post/3mqjngi26od2u", "content": "\ud83d\udd0d Top signals this week:\n\nCVEs: CVE-2026-48282, CVE-2026-50656, CVE-2026-55255, CVE-2026-20896, CVE-2026-53359\nActors: Ransomware, Apt, Play\n\nFull intel: https://matlock.ca/cybersecnews", "creation_timestamp": "2026-07-13T12:01:15.571749Z"}, {"uuid": "23abb9b5-8091-4970-a142-50318d44a74b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://t.me/poxek/6232", "content": "CVE-2026-20896 \u0432 Gitea \u0443\u0436\u0435 \u043d\u0430\u0447\u0430\u043b\u0438 \u0434\u0435\u0440\u0433\u0430\u0442\u044c \u0432\u0436\u0438\u0432\u0443\u044e: \u043f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Sysdig, \u043f\u0435\u0440\u0432\u0430\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u044f\u0432\u0438\u043b\u0430\u0441\u044c \u0447\u0435\u0440\u0435\u0437 13 \u0434\u043d\u0435\u0439 \u043f\u043e\u0441\u043b\u0435 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f\n\n\u0412 Docker-\u0448\u0430\u0431\u043b\u043e\u043d\u0435 app.ini \u0431\u044b\u043b \u0434\u0435\u0444\u043e\u043b\u0442 REVERSE_PROXY_TRUSTED_PROXIES = *, \u0445\u043e\u0442\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u0434\u043e\u043b\u0436\u043d\u043e \u0434\u043e\u0432\u0435\u0440\u044f\u0442\u044c \u0442\u043e\u043b\u044c\u043a\u043e loopback. \u0415\u0441\u043b\u0438 \u0430\u0434\u043c\u0438\u043d \u0432\u043a\u043b\u044e\u0447\u0438\u043b ENABLE_REVERSE_PROXY_AUTHENTICATION \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0437\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0438\u043c reverse proxy \u0438 \u043f\u0440\u0438 \u044d\u0442\u043e\u043c HTTP-\u043f\u043e\u0440\u0442 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043d\u0430\u043f\u0440\u044f\u043c\u0443\u044e, \u043b\u044e\u0431\u043e\u0439 \u043a\u043b\u0438\u0435\u043d\u0442 \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0441\u043b\u0430\u0442\u044c X-WEBAUTH-USER: poxek \u0438 \u043f\u043e\u043f\u0430\u0441\u0442\u044c \u0432 Gitea \u043a\u0430\u043a poxek \u0431\u0435\u0437 \u043f\u0430\u0440\u043e\u043b\u044f \u0438 \u0442\u043e\u043a\u0435\u043d\u0430.\n\n\u267e\ufe0f\u0418\u043c\u043f\u0430\u043a\u0442\u267e\ufe0f\n\u0418\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0439 \u0438\u043b\u0438 \u0443\u0433\u0430\u0434\u044b\u0432\u0430\u0435\u043c\u044b\u0439 \u043b\u043e\u0433\u0438\u043d \u043f\u0440\u0435\u0432\u0440\u0430\u0449\u0430\u0435\u0442\u0441\u044f \u0432 \u0441\u0435\u0441\u0441\u0438\u044e \u044d\u0442\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u0414\u043b\u044f admin, gitea_admin \u0438 \u043f\u043e\u0445\u043e\u0436\u0438\u0445 \u0438\u043c\u0435\u043d \u044d\u0442\u043e \u0443\u0436\u0435 \u043f\u043e\u043b\u043d\u044b\u0439 takeover Gitea \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f: \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u044b\u0435 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438, \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438, \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438, packages, \u0440\u0435\u043b\u0438\u0437\u044b, \u0432\u0435\u0431\u0445\u0443\u043a\u0438 \u0438 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e downstream CI/CD. RCE \u043d\u0435 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0433\u0430\u0440\u0430\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0431\u043b\u0435\u043a\u0431\u043e\u043a\u0441 \u0438\u043c\u043f\u0430\u043a\u0442\u043e\u043c \u0441\u0430\u043c\u043e\u0439 CVE; \u0435\u0433\u043e \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u044f\u0432\u043b\u044f\u0442\u044c \u0442\u043e\u043b\u044c\u043a\u043e \u0435\u0441\u043b\u0438 \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u0430\u044f \u0438\u043d\u0441\u0442\u0430\u043b\u043b\u044f\u0446\u0438\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0434\u043e\u0439\u0442\u0438 \u0434\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0447\u0435\u0440\u0435\u0437 runner, \u0445\u0443\u043a\u0438, CI-\u0441\u0435\u043a\u0440\u0435\u0442\u044b \u0438\u043b\u0438 deployment-\u043f\u0430\u0439\u043f\u043b\u0430\u0439\u043d.\n\n\u267e\ufe0fPoC\u267e\ufe0f\n\u042f \u043d\u0435 \u043d\u0430\u0448\u0451\u043b \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0445 PoC, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u043d\u0430\u043f\u0438\u0441\u0430\u043b \u0441\u0432\u043e\u0439 \u0438 \u0432\u044b\u043b\u043e\u0436\u0438\u043b \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0439 PoC/\u0447\u0435\u043a\u0435\u0440: szybnev/cve-2026-20896-gitea-poc\n\n\u0412 \u0440\u0435\u043f\u0435 \u0435\u0441\u0442\u044c Go-\u0432\u0435\u0440\u0441\u0438\u044f \u0434\u043b\u044f \u043c\u0430\u0441\u0441\u043e\u0432\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0441 --targets, --user-file, --concurrency, --jsonl \u0438 --dry-run, \u043f\u043b\u044e\u0441 \u043f\u0440\u043e\u0441\u0442\u043e\u0439 Bash \u0441\u043a\u0440\u0438\u043f\u0442\u0438\u043a \u0431\u0435\u0437 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u0427\u0435\u043a\u0435\u0440 \u0441\u043d\u0430\u0447\u0430\u043b\u0430 \u043f\u0430\u0440\u0441\u0438\u0442 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0443 \u0438 \u043d\u0435 \u0444\u0430\u0437\u0437\u0438\u0442 usernames, \u0435\u0441\u043b\u0438 \u0432\u0438\u0434\u0438\u0442 Gitea >=1.26.3, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440 Powered by Gitea Version: 1.26.4. \u0414\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0439 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 1.26.2 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442 impersonation \u043f\u043e title dashboard \u0431\u0435\u0437 cookie \u0438 \u043f\u0430\u0440\u043e\u043b\u044f.\n\n\u267e\ufe0f\u041c\u0438\u0442\u0438\u0433\u0430\u0446\u0438\u044f\u267e\ufe0f\n\u25aa\ufe0f\u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c\u0441\u044f \u043c\u0438\u043d\u0438\u043c\u0443\u043c \u0434\u043e 1.26.3, \u043b\u0443\u0447\u0448\u0435 \u0434\u043e 1.26.4+;\n\u25aa\ufe0f\u043d\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u0442\u044c giea \u043d\u0430\u043f\u0440\u044f\u043c\u0443\u044e\n\u25aa\ufe0f\u044f\u0432\u043d\u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c trusted proxies\n\u25aa\ufe0f\u043d\u0435 \u0432\u043a\u043b\u044e\u0447\u0430\u0442\u044c reverse-proxy auth \u0431\u0435\u0437 \u043f\u043e\u043d\u044f\u0442\u043d\u043e\u0439 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0433\u0440\u0430\u043d\u0438\u0446\u044b\n\n\ud83d\udd17\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438:\nGHSA-f75j-4cw6-rmx4 / Gitea 1.26.3/1.26.4 release notes\nfix PR #38151 / CVE record\nSysdig telemetry via The Hacker News\n\n\ud83c\udf1a @poxek | \ud83c\udf1a @poxek_ai | \ud83d\udcf2 MAX", "creation_timestamp": "2026-07-13T13:00:04.298669Z"}, {"uuid": "0b5434e5-f2b7-4e7d-9b92-9e531eb18311", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://t.me/true_secator/8383", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 Sysdig \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u044e\u0442 \u043e \u043d\u0430\u0447\u0430\u043b\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043e\u0431\u0440\u0430\u0437\u0430\u0445 Docker Gitea.\n\nCVE-2026-20896\u00a0(CVSS: 9,8) \u043e\u0431\u0443\u0441\u043b\u043e\u0432\u043b\u0435\u043d\u0430 \u0442\u0435\u043c, \u0447\u0442\u043e \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430 DevOps \u0434\u043e\u0432\u0435\u0440\u044f\u0435\u0442 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0443 X-WEBAUTH-USER \u043e\u0442 \u043b\u044e\u0431\u043e\u0433\u043e \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u0433\u043e IP, \u0447\u0442\u043e \u0444\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u043a\u043b\u0438\u0435\u043d\u0442\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0410\u043b\u0438 \u041c\u0443\u0441\u0442\u0430\u0444\u0430, \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u043f\u0440\u0438\u043f\u0438\u0441\u044b\u0432\u0430\u044e\u0442 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0441\u043e\u043e\u0431\u0449\u0438\u043b, \u0447\u0442\u043e \u043e\u0431\u0440\u0430\u0437\u044b Docker \u043e\u0442 Gitea \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u043b\u0438 \u0448\u0430\u0431\u043b\u043e\u043d app.ini, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0436\u0435\u0441\u0442\u043a\u043e \u0437\u0430\u0434\u0430\u043d\u043e \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 REVERSE_PROXY_TRUSTED_PROXIES = *.\n\n\u0424\u0430\u0439\u043b app.ini \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u043c \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u043c \u0444\u0430\u0439\u043b\u043e\u043c \u0434\u043b\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430\u043c\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f\u043c\u0438 \u043a \u0431\u0430\u0437\u0430\u043c \u0434\u0430\u043d\u043d\u044b\u0445, \u043f\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u0435\u043c \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u043c\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f.\n\n\u041f\u0440\u0438 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u043e\u043c \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u043c \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u044d\u0442\u043e\u0442 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u0447\u043d\u044b\u0439 \u0437\u043d\u0430\u043a \u0434\u043e\u0432\u0435\u0440\u044f\u0435\u0442 \u043a\u0430\u0436\u0434\u043e\u043c\u0443 IP \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0430, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u043b\u044e\u0431\u043e\u0439, \u043a\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043f\u043e\u0440\u0442\u0443, \u043c\u043e\u0436\u0435\u0442 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043e\u043a X-WEBAUTH-USER \u0438 \u043f\u0440\u043e\u0439\u0442\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u043a\u0430\u043a \u043b\u044e\u0431\u043e\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c, \u0431\u0435\u0437 \u043f\u0430\u0440\u043e\u043b\u044f \u0438 \u0442\u043e\u043a\u0435\u043d\u0430.\n\n\u0421\u0442\u043e\u0438\u0442 \u043e\u0442\u043c\u0435\u0442\u0438\u0442\u044c, \u0447\u0442\u043e \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 REVERSE_PROXY_TRUSTED_PROXIES - 127.0.0.0/8,::1/128, \u0447\u0442\u043e \u043e\u0437\u043d\u0430\u0447\u0430\u0435\u0442, \u0447\u0442\u043e \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d \u0442\u043e\u043b\u044c\u043a\u043e localhost, \u0442\u043e \u0435\u0441\u0442\u044c \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0439 \u0441\u0432\u044f\u0437\u0438.\n\n\u041e\u0434\u043d\u0430\u043a\u043e \u0432 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u043c \u043e\u0431\u0440\u0430\u0437\u0435 Docker \u044d\u0442\u043e \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043d\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f, \u0432\u043c\u0435\u0441\u0442\u043e \u043d\u0435\u0433\u043e \u0436\u0435\u0441\u0442\u043a\u043e \u0437\u0430\u0434\u0430\u043d \u0441\u0438\u043c\u0432\u043e\u043b \"*\". \u0414\u0440\u0443\u0433\u0438\u043c\u0438 \u0441\u043b\u043e\u0432\u0430\u043c\u0438, \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u0432 \u0441\u043f\u0438\u0441\u043a\u0435 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0444\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442.\n\n\u0422\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u0435\u0441\u043b\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 ENABLE_REVERSE_PROXY_AUTHENTICATION = true, \u0447\u0442\u043e\u0431\u044b Gitea \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0438\u0439 \u043e\u0431\u0440\u0430\u0442\u043d\u044b\u0439 \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440, \u0438 \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 REVERSE_PROXY_TRUSTED_PROXIES \u0432 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, \u044d\u0442\u043e \u0440\u0430\u0437\u0440\u0435\u0448\u0430\u0435\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0439 HTTP-\u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043e\u043a X-WEBAUTH-USER \u0441 \u043b\u044e\u0431\u043e\u0433\u043e \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u0433\u043e IP, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0436\u0435\u0442 \u0434\u043e\u0441\u0442\u0438\u0447\u044c \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430.\n\n\u041b\u044e\u0431\u043e\u0439 \u043f\u0440\u043e\u0446\u0435\u0441\u0441, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0436\u0435\u0442 \u043d\u0430\u043f\u0440\u044f\u043c\u0443\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a HTTP-\u043f\u043e\u0440\u0442\u0443 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 Gitea - \u043d\u0435 \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u044b\u0439 \u0434\u043b\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440 - \u043c\u043e\u0436\u0435\u0442 \u0432\u044b\u0434\u0430\u0442\u044c \u0441\u0435\u0431\u044f \u0437\u0430 \u043b\u044e\u0431\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0447\u044c\u0435 \u0438\u043c\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e \u0438\u043b\u0438 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0443\u0433\u0430\u0434\u0430\u043d\u043e.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043e\u0431\u0440\u0430\u0437\u044b Docker Gitea \u0432\u0435\u0440\u0441\u0438\u0439 \u0434\u043e 1.26.2 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e. \u041e\u043d\u0430 \u0431\u044b\u043b\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 1.26.3, \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u0439 \u0432 \u043a\u043e\u043d\u0446\u0435 \u043f\u0440\u043e\u0448\u043b\u043e\u0433\u043e \u043c\u0435\u0441\u044f\u0446\u0430, \u0433\u0434\u0435 \u0431\u044b\u043b \u0443\u0434\u0430\u043b\u0435\u043d \u0441\u0438\u043c\u0432\u043e\u043b \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \"*\", \u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u0447\u0435\u0440\u0435\u0437 \u043e\u0431\u0440\u0430\u0442\u043d\u044b\u0439 \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440 \u0441\u0442\u0430\u043b\u0430 \u043d\u0435\u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0439.\n\nSysdig \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e\u0431 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0438 \u043f\u0435\u0440\u0432\u043e\u0439 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u0441\u043f\u0443\u0441\u0442\u044f 13 \u0434\u043d\u0435\u0439 \u043f\u043e\u0441\u043b\u0435 \u0435\u0435 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f. \u0420\u0435\u0447\u044c \u0438\u0434\u0435\u0442 \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u043e 6200 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0438\u0437 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0430 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u0430\u0445 Gitea.\n\n\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u043f\u0435\u0440\u0432\u044b\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441 IP-\u0430\u0434\u0440\u0435\u0441\u0430 \u0441\u0435\u0440\u0432\u0438\u0441\u0430 ProtonVPN, 159.26.98[.]241, \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u043d\u0435 \u043f\u0440\u0438\u0432\u0435\u043b\u0430 \u043a \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438\u043b\u0438 \u0430\u0442\u0430\u043a\u0435. \u041a\u0430\u043a \u0441\u0447\u0438\u0442\u0430\u044e\u0442 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438, \u044d\u0442\u043e \u0441\u0432\u044f\u0437\u0430\u043d\u043e \u0441 \u0442\u0435\u043c, \u0447\u0442\u043e \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0431\u044b\u043b\u043e \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043e \u043d\u0430 \u0440\u0430\u043d\u043d\u0435\u0439 \u0441\u0442\u0430\u0434\u0438\u0438, \u0434\u043e \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u0430\u0442\u0430\u043a\u0430 \u0443\u0441\u043f\u0435\u043b\u0430 \u0440\u0430\u0437\u0432\u0438\u0442\u044c\u0441\u044f \u0434\u0430\u043b\u044c\u0448\u0435 \u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0439 \u0444\u0430\u0437\u044b.\n\n\u0423\u0447\u0438\u0442\u044b\u0432\u0430\u044f \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0438 \u043d\u0430\u0447\u0430\u0432\u0448\u0443\u044e\u0441\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e, \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u043a\u0440\u0430\u0439\u043d\u0435 \u0432\u0430\u0436\u043d\u043e \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0441\u043a\u043e\u0440\u0435\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u0438\u0442\u044c \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u043e\u043f\u0442\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u044b.", "creation_timestamp": "2026-07-13T13:00:05.388873Z"}, {"uuid": "9294b064-9ab3-4e41-a8f2-a20054df64cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://t.me/GithubRedTeam/92405", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-20896-gitea-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a szybnev\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Go\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-07 20:31:29\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-20896 Gitea Docker X-WEBAUTH-USER auth bypass checker\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T22:00:10.059989Z"}, {"uuid": "bd38a2a4-7514-4e64-9bd8-b7a57425d330", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://t.me/GithubRedTeam/92061", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-20896\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a rz1027\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-05 15:52:46\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPublic PoC and detector for CVE-2026-20896 (\"Gitea Docker: One Header, Any User\")\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T22:00:12.397895Z"}, {"uuid": "9fa62c00-6a61-461c-88bd-fa23731e980d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://t.me/GithubRedTeam/91524", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-20896\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a kaleth4\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-02 00:23:50\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T22:00:15.684185Z"}, {"uuid": "08bebc64-3e3b-4b74-aff8-4c46de69c8af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://t.me/GithubRedTeam/91524", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-20896\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a kaleth4\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-02 00:23:50\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-14T00:00:32.403303Z"}, {"uuid": "b41f52f3-0124-4db1-9c1e-bfddf8217510", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://t.me/GithubRedTeam/92405", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-20896-gitea-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a szybnev\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Go\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-07 20:31:29\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-20896 Gitea Docker X-WEBAUTH-USER auth bypass checker\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-14T00:00:18.608029Z"}, {"uuid": "ba3f9705-1398-49bf-b0cc-4886da8a2e0f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://t.me/GithubRedTeam/92061", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-20896\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a rz1027\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-05 15:52:46\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPublic PoC and detector for CVE-2026-20896 (\"Gitea Docker: One Header, Any User\")\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-14T00:00:20.592240Z"}, {"uuid": "cc3f60f3-50e3-4e4f-b20a-c3ed2593e7b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "exploited", "source": "https://t.me/true_secator/8383", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 Sysdig \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u044e\u0442 \u043e \u043d\u0430\u0447\u0430\u043b\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043e\u0431\u0440\u0430\u0437\u0430\u0445 Docker Gitea.\n\nCVE-2026-20896\u00a0(CVSS: 9,8) \u043e\u0431\u0443\u0441\u043b\u043e\u0432\u043b\u0435\u043d\u0430 \u0442\u0435\u043c, \u0447\u0442\u043e \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430 DevOps \u0434\u043e\u0432\u0435\u0440\u044f\u0435\u0442 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0443 X-WEBAUTH-USER \u043e\u0442 \u043b\u044e\u0431\u043e\u0433\u043e \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u0433\u043e IP, \u0447\u0442\u043e \u0444\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u043a\u043b\u0438\u0435\u043d\u0442\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0410\u043b\u0438 \u041c\u0443\u0441\u0442\u0430\u0444\u0430, \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u043f\u0440\u0438\u043f\u0438\u0441\u044b\u0432\u0430\u044e\u0442 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0441\u043e\u043e\u0431\u0449\u0438\u043b, \u0447\u0442\u043e \u043e\u0431\u0440\u0430\u0437\u044b Docker \u043e\u0442 Gitea \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u043b\u0438 \u0448\u0430\u0431\u043b\u043e\u043d app.ini, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0436\u0435\u0441\u0442\u043a\u043e \u0437\u0430\u0434\u0430\u043d\u043e \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 REVERSE_PROXY_TRUSTED_PROXIES = *.\n\n\u0424\u0430\u0439\u043b app.ini \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u043c \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u043c \u0444\u0430\u0439\u043b\u043e\u043c \u0434\u043b\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430\u043c\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f\u043c\u0438 \u043a \u0431\u0430\u0437\u0430\u043c \u0434\u0430\u043d\u043d\u044b\u0445, \u043f\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u0435\u043c \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u043c\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f.\n\n\u041f\u0440\u0438 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u043e\u043c \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u043c \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u044d\u0442\u043e\u0442 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u0447\u043d\u044b\u0439 \u0437\u043d\u0430\u043a \u0434\u043e\u0432\u0435\u0440\u044f\u0435\u0442 \u043a\u0430\u0436\u0434\u043e\u043c\u0443 IP \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0430, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u043b\u044e\u0431\u043e\u0439, \u043a\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043f\u043e\u0440\u0442\u0443, \u043c\u043e\u0436\u0435\u0442 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043e\u043a X-WEBAUTH-USER \u0438 \u043f\u0440\u043e\u0439\u0442\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u043a\u0430\u043a \u043b\u044e\u0431\u043e\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c, \u0431\u0435\u0437 \u043f\u0430\u0440\u043e\u043b\u044f \u0438 \u0442\u043e\u043a\u0435\u043d\u0430.\n\n\u0421\u0442\u043e\u0438\u0442 \u043e\u0442\u043c\u0435\u0442\u0438\u0442\u044c, \u0447\u0442\u043e \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 REVERSE_PROXY_TRUSTED_PROXIES - 127.0.0.0/8,::1/128, \u0447\u0442\u043e \u043e\u0437\u043d\u0430\u0447\u0430\u0435\u0442, \u0447\u0442\u043e \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d \u0442\u043e\u043b\u044c\u043a\u043e localhost, \u0442\u043e \u0435\u0441\u0442\u044c \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0439 \u0441\u0432\u044f\u0437\u0438.\n\n\u041e\u0434\u043d\u0430\u043a\u043e \u0432 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u043c \u043e\u0431\u0440\u0430\u0437\u0435 Docker \u044d\u0442\u043e \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043d\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f, \u0432\u043c\u0435\u0441\u0442\u043e \u043d\u0435\u0433\u043e \u0436\u0435\u0441\u0442\u043a\u043e \u0437\u0430\u0434\u0430\u043d \u0441\u0438\u043c\u0432\u043e\u043b \"*\". \u0414\u0440\u0443\u0433\u0438\u043c\u0438 \u0441\u043b\u043e\u0432\u0430\u043c\u0438, \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u0432 \u0441\u043f\u0438\u0441\u043a\u0435 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0444\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442.\n\n\u0422\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u0435\u0441\u043b\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 ENABLE_REVERSE_PROXY_AUTHENTICATION = true, \u0447\u0442\u043e\u0431\u044b Gitea \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0438\u0439 \u043e\u0431\u0440\u0430\u0442\u043d\u044b\u0439 \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440, \u0438 \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 REVERSE_PROXY_TRUSTED_PROXIES \u0432 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, \u044d\u0442\u043e \u0440\u0430\u0437\u0440\u0435\u0448\u0430\u0435\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0439 HTTP-\u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043e\u043a X-WEBAUTH-USER \u0441 \u043b\u044e\u0431\u043e\u0433\u043e \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u0433\u043e IP, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0436\u0435\u0442 \u0434\u043e\u0441\u0442\u0438\u0447\u044c \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430.\n\n\u041b\u044e\u0431\u043e\u0439 \u043f\u0440\u043e\u0446\u0435\u0441\u0441, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0436\u0435\u0442 \u043d\u0430\u043f\u0440\u044f\u043c\u0443\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a HTTP-\u043f\u043e\u0440\u0442\u0443 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 Gitea - \u043d\u0435 \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u044b\u0439 \u0434\u043b\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440 - \u043c\u043e\u0436\u0435\u0442 \u0432\u044b\u0434\u0430\u0442\u044c \u0441\u0435\u0431\u044f \u0437\u0430 \u043b\u044e\u0431\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0447\u044c\u0435 \u0438\u043c\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e \u0438\u043b\u0438 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0443\u0433\u0430\u0434\u0430\u043d\u043e.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043e\u0431\u0440\u0430\u0437\u044b Docker Gitea \u0432\u0435\u0440\u0441\u0438\u0439 \u0434\u043e 1.26.2 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e. \u041e\u043d\u0430 \u0431\u044b\u043b\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 1.26.3, \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u0439 \u0432 \u043a\u043e\u043d\u0446\u0435 \u043f\u0440\u043e\u0448\u043b\u043e\u0433\u043e \u043c\u0435\u0441\u044f\u0446\u0430, \u0433\u0434\u0435 \u0431\u044b\u043b \u0443\u0434\u0430\u043b\u0435\u043d \u0441\u0438\u043c\u0432\u043e\u043b \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \"*\", \u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u0447\u0435\u0440\u0435\u0437 \u043e\u0431\u0440\u0430\u0442\u043d\u044b\u0439 \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440 \u0441\u0442\u0430\u043b\u0430 \u043d\u0435\u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0439.\n\nSysdig \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e\u0431 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0438 \u043f\u0435\u0440\u0432\u043e\u0439 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u0441\u043f\u0443\u0441\u0442\u044f 13 \u0434\u043d\u0435\u0439 \u043f\u043e\u0441\u043b\u0435 \u0435\u0435 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f. \u0420\u0435\u0447\u044c \u0438\u0434\u0435\u0442 \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u043e 6200 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0438\u0437 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0430 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u0430\u0445 Gitea.\n\n\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u043f\u0435\u0440\u0432\u044b\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441 IP-\u0430\u0434\u0440\u0435\u0441\u0430 \u0441\u0435\u0440\u0432\u0438\u0441\u0430 ProtonVPN, 159.26.98[.]241, \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u043d\u0435 \u043f\u0440\u0438\u0432\u0435\u043b\u0430 \u043a \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438\u043b\u0438 \u0430\u0442\u0430\u043a\u0435. \u041a\u0430\u043a \u0441\u0447\u0438\u0442\u0430\u044e\u0442 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438, \u044d\u0442\u043e \u0441\u0432\u044f\u0437\u0430\u043d\u043e \u0441 \u0442\u0435\u043c, \u0447\u0442\u043e \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0431\u044b\u043b\u043e \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043e \u043d\u0430 \u0440\u0430\u043d\u043d\u0435\u0439 \u0441\u0442\u0430\u0434\u0438\u0438, \u0434\u043e \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u0430\u0442\u0430\u043a\u0430 \u0443\u0441\u043f\u0435\u043b\u0430 \u0440\u0430\u0437\u0432\u0438\u0442\u044c\u0441\u044f \u0434\u0430\u043b\u044c\u0448\u0435 \u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0439 \u0444\u0430\u0437\u044b.\n\n\u0423\u0447\u0438\u0442\u044b\u0432\u0430\u044f \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0438 \u043d\u0430\u0447\u0430\u0432\u0448\u0443\u044e\u0441\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e, \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u043a\u0440\u0430\u0439\u043d\u0435 \u0432\u0430\u0436\u043d\u043e \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0441\u043a\u043e\u0440\u0435\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u0438\u0442\u044c \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u043e\u043f\u0442\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u044b.", "creation_timestamp": "2026-07-14T00:00:47.212420Z"}, {"uuid": "3354f965-0e92-4e6c-862a-6408e221bf5d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "exploited", "source": "https://t.me/poxek/6232", "content": "CVE-2026-20896 \u0432 Gitea \u0443\u0436\u0435 \u043d\u0430\u0447\u0430\u043b\u0438 \u0434\u0435\u0440\u0433\u0430\u0442\u044c \u0432\u0436\u0438\u0432\u0443\u044e: \u043f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Sysdig, \u043f\u0435\u0440\u0432\u0430\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u044f\u0432\u0438\u043b\u0430\u0441\u044c \u0447\u0435\u0440\u0435\u0437 13 \u0434\u043d\u0435\u0439 \u043f\u043e\u0441\u043b\u0435 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f\n\n\u0412 Docker-\u0448\u0430\u0431\u043b\u043e\u043d\u0435 app.ini \u0431\u044b\u043b \u0434\u0435\u0444\u043e\u043b\u0442 REVERSE_PROXY_TRUSTED_PROXIES = *, \u0445\u043e\u0442\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u0434\u043e\u043b\u0436\u043d\u043e \u0434\u043e\u0432\u0435\u0440\u044f\u0442\u044c \u0442\u043e\u043b\u044c\u043a\u043e loopback. \u0415\u0441\u043b\u0438 \u0430\u0434\u043c\u0438\u043d \u0432\u043a\u043b\u044e\u0447\u0438\u043b ENABLE_REVERSE_PROXY_AUTHENTICATION \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0437\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0438\u043c reverse proxy \u0438 \u043f\u0440\u0438 \u044d\u0442\u043e\u043c HTTP-\u043f\u043e\u0440\u0442 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043d\u0430\u043f\u0440\u044f\u043c\u0443\u044e, \u043b\u044e\u0431\u043e\u0439 \u043a\u043b\u0438\u0435\u043d\u0442 \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0441\u043b\u0430\u0442\u044c X-WEBAUTH-USER: poxek \u0438 \u043f\u043e\u043f\u0430\u0441\u0442\u044c \u0432 Gitea \u043a\u0430\u043a poxek \u0431\u0435\u0437 \u043f\u0430\u0440\u043e\u043b\u044f \u0438 \u0442\u043e\u043a\u0435\u043d\u0430.\n\n\u267e\ufe0f\u0418\u043c\u043f\u0430\u043a\u0442\u267e\ufe0f\n\u0418\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0439 \u0438\u043b\u0438 \u0443\u0433\u0430\u0434\u044b\u0432\u0430\u0435\u043c\u044b\u0439 \u043b\u043e\u0433\u0438\u043d \u043f\u0440\u0435\u0432\u0440\u0430\u0449\u0430\u0435\u0442\u0441\u044f \u0432 \u0441\u0435\u0441\u0441\u0438\u044e \u044d\u0442\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u0414\u043b\u044f admin, gitea_admin \u0438 \u043f\u043e\u0445\u043e\u0436\u0438\u0445 \u0438\u043c\u0435\u043d \u044d\u0442\u043e \u0443\u0436\u0435 \u043f\u043e\u043b\u043d\u044b\u0439 takeover Gitea \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f: \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u044b\u0435 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438, \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438, \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438, packages, \u0440\u0435\u043b\u0438\u0437\u044b, \u0432\u0435\u0431\u0445\u0443\u043a\u0438 \u0438 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e downstream CI/CD. RCE \u043d\u0435 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0433\u0430\u0440\u0430\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0431\u043b\u0435\u043a\u0431\u043e\u043a\u0441 \u0438\u043c\u043f\u0430\u043a\u0442\u043e\u043c \u0441\u0430\u043c\u043e\u0439 CVE; \u0435\u0433\u043e \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u044f\u0432\u043b\u044f\u0442\u044c \u0442\u043e\u043b\u044c\u043a\u043e \u0435\u0441\u043b\u0438 \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u0430\u044f \u0438\u043d\u0441\u0442\u0430\u043b\u043b\u044f\u0446\u0438\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0434\u043e\u0439\u0442\u0438 \u0434\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0447\u0435\u0440\u0435\u0437 runner, \u0445\u0443\u043a\u0438, CI-\u0441\u0435\u043a\u0440\u0435\u0442\u044b \u0438\u043b\u0438 deployment-\u043f\u0430\u0439\u043f\u043b\u0430\u0439\u043d.\n\n\u267e\ufe0fPoC\u267e\ufe0f\n\u042f \u043d\u0435 \u043d\u0430\u0448\u0451\u043b \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0445 PoC, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u043d\u0430\u043f\u0438\u0441\u0430\u043b \u0441\u0432\u043e\u0439 \u0438 \u0432\u044b\u043b\u043e\u0436\u0438\u043b \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0439 PoC/\u0447\u0435\u043a\u0435\u0440: szybnev/cve-2026-20896-gitea-poc\n\n\u0412 \u0440\u0435\u043f\u0435 \u0435\u0441\u0442\u044c Go-\u0432\u0435\u0440\u0441\u0438\u044f \u0434\u043b\u044f \u043c\u0430\u0441\u0441\u043e\u0432\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0441 --targets, --user-file, --concurrency, --jsonl \u0438 --dry-run, \u043f\u043b\u044e\u0441 \u043f\u0440\u043e\u0441\u0442\u043e\u0439 Bash \u0441\u043a\u0440\u0438\u043f\u0442\u0438\u043a \u0431\u0435\u0437 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u0427\u0435\u043a\u0435\u0440 \u0441\u043d\u0430\u0447\u0430\u043b\u0430 \u043f\u0430\u0440\u0441\u0438\u0442 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0443 \u0438 \u043d\u0435 \u0444\u0430\u0437\u0437\u0438\u0442 usernames, \u0435\u0441\u043b\u0438 \u0432\u0438\u0434\u0438\u0442 Gitea >=1.26.3, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440 Powered by Gitea Version: 1.26.4. \u0414\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0439 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 1.26.2 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442 impersonation \u043f\u043e title dashboard \u0431\u0435\u0437 cookie \u0438 \u043f\u0430\u0440\u043e\u043b\u044f.\n\n\u267e\ufe0f\u041c\u0438\u0442\u0438\u0433\u0430\u0446\u0438\u044f\u267e\ufe0f\n\u25aa\ufe0f\u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c\u0441\u044f \u043c\u0438\u043d\u0438\u043c\u0443\u043c \u0434\u043e 1.26.3, \u043b\u0443\u0447\u0448\u0435 \u0434\u043e 1.26.4+;\n\u25aa\ufe0f\u043d\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u0442\u044c giea \u043d\u0430\u043f\u0440\u044f\u043c\u0443\u044e\n\u25aa\ufe0f\u044f\u0432\u043d\u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c trusted proxies\n\u25aa\ufe0f\u043d\u0435 \u0432\u043a\u043b\u044e\u0447\u0430\u0442\u044c reverse-proxy auth \u0431\u0435\u0437 \u043f\u043e\u043d\u044f\u0442\u043d\u043e\u0439 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0433\u0440\u0430\u043d\u0438\u0446\u044b\n\n\ud83d\udd17\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438:\nGHSA-f75j-4cw6-rmx4 / Gitea 1.26.3/1.26.4 release notes\nfix PR #38151 / CVE record\nSysdig telemetry via The Hacker News\n\n\ud83c\udf1a @poxek | \ud83c\udf1a @poxek_ai | \ud83d\udcf2 MAX", "creation_timestamp": "2026-07-14T00:00:47.940306Z"}, {"uuid": "11592fdc-c52a-463a-96d4-b2ae8191de95", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/diesec.bsky.social/post/3mqm2hyngyx26", "content": "Gitea Docker CVE-2026-20896 (CVSS 9.8): one spoofed HTTP header = full admin access. ~6,200 exposed instances. Active exploitation confirmed. Patch to 1.26.4 now.\n\n\ud83c\uddec\ud83c\udde7 zurl.co/G9E8x\n\ud83c\udde9\ud83c\uddea zurl.co/KwwWP \n\n #CyberSecurity #Gitea #CVE", "creation_timestamp": "2026-07-14T11:00:04.968761Z"}, {"uuid": "2dac214c-1a3c-4512-9ceb-b040bb766354", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://t.me/TengkorakCyberCrewzz/11653", "content": "Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure \u2013 thehackernews.com\n\nTue, 07 Jul 2026 00:28:59", "creation_timestamp": "2026-07-14T12:00:04.742409Z"}, {"uuid": "f369bc48-267a-4806-bb67-012b8a229f1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://t.me/ctinow/252886", "content": "Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure\nhttps://ift.tt/Z1IT7qt", "creation_timestamp": "2026-07-14T14:00:04.759431Z"}, {"uuid": "7f251082-3149-4506-8c95-0ddbf27cb044", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://t.me/cibsecurity/89930", "content": "\ud83d\udd8b\ufe0f Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure \ud83d\udd8b\ufe0f\n\nThreat actors have been observed attempting to exploit a recently patched critical security flaw in Gitea Docker images, according to Sysdig.  The vulnerability in question is CVE202620896 CVSS score 9.8, a vulnerability that stems from the DevOps platform trusting the \"XWEBAUTHUSER\" header from any source IP address, effectively allowing an unauthenticated internet client to get elevated.\n\n\ud83d\udcd6 Read more.\n\n\ud83d\udd17 Via \"The Hacker News\"\n\n----------\n\ud83d\udc41\ufe0f Seen on @cibsecurity", "creation_timestamp": "2026-07-14T14:00:05.432863Z"}, {"uuid": "162462d6-34d4-41df-90a8-47fc1a531504", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://t.me/TengkorakCyberCrewzz/11653", "content": "Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure \u2013 thehackernews.com\n\nTue, 07 Jul 2026 00:28:59", "creation_timestamp": "2026-07-15T00:00:25.188986Z"}, {"uuid": "fd9f6e10-6fff-4bd0-8592-08e03c49b19e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "exploited", "source": "https://t.me/cibsecurity/89930", "content": "\ud83d\udd8b\ufe0f Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure \ud83d\udd8b\ufe0f\n\nThreat actors have been observed attempting to exploit a recently patched critical security flaw in Gitea Docker images, according to Sysdig.  The vulnerability in question is CVE202620896 CVSS score 9.8, a vulnerability that stems from the DevOps platform trusting the \"XWEBAUTHUSER\" header from any source IP address, effectively allowing an unauthenticated internet client to get elevated.\n\n\ud83d\udcd6 Read more.\n\n\ud83d\udd17 Via \"The Hacker News\"\n\n----------\n\ud83d\udc41\ufe0f Seen on @cibsecurity", "creation_timestamp": "2026-07-15T00:00:22.656836Z"}, {"uuid": "948eb3c7-9796-474b-8cfd-86ed33264a9b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://t.me/ctinow/252886", "content": "Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure\nhttps://ift.tt/Z1IT7qt", "creation_timestamp": "2026-07-15T00:00:23.392630Z"}, {"uuid": "19e6b3fd-15b7-4cc2-8305-3e602838b41f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://t.me/GithubRedTeam/91524", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-20896\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a kaleth4\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-02 00:23:50\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-15T00:00:26.112650Z"}, {"uuid": "d7566fc2-c728-43ec-bf26-31547c4bb856", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/92061", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-20896\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a rz1027\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-05 15:52:46\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPublic PoC and detector for CVE-2026-20896 (\"Gitea Docker: One Header, Any User\")\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-15T00:00:29.628301Z"}, {"uuid": "095ff95a-493e-4c21-8c2a-04fd5f1f99a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/92405", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-20896-gitea-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a szybnev\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Go\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-07 20:31:29\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-20896 Gitea Docker X-WEBAUTH-USER auth bypass checker\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-15T00:00:31.635263Z"}, {"uuid": "3c9d5f27-a0fc-425b-8b95-d883cc28c04a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "exploited", "source": "https://t.me/thehackernews/9422", "content": "\ud83d\udea8 CVE-2026-20896 saw its first in-the-wild attempt 13 days after disclosure.\n\nThe Gitea Docker flaw lets reachable containers trust spoofed X-WEBAUTH-USER headers when reverse proxy auth is enabled.\n\nSee which setups are exposed and where the probe stopped: https://thehackernews.com/2026/07/threat-actors-probe-gitea-docker-flaw.html", "creation_timestamp": "2026-07-15T12:00:03.977493Z"}, {"uuid": "1d3d9627-cc0b-4498-8515-9a5583745045", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://t.me/information_security_channel/55535", "content": "Critical Gitea Flaw Under Active Exploitation, Researchers Warn\nhttps://www.securityweek.com/critical-gitea-flaw-under-active-exploitation-researchers-warn/\n\nAttackers are exploiting the critical Gitea vulnerability CVE-2026-20896 to bypass authentication with a single HTTP header and access vulnerable repositories and secrets.\nThe post Critical Gitea Flaw Under Active Exploitation, Researchers Warn (https://www.securityweek.com/critical-gitea-flaw-under-active-exploitation-researchers-warn/) appeared first on SecurityWeek (https://www.securityweek.com/).", "creation_timestamp": "2026-07-15T12:00:06.101989Z"}, {"uuid": "6996069e-433d-421e-a56c-97ef6e05283f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "exploited", "source": "https://t.me/information_security_channel/55535", "content": "Critical Gitea Flaw Under Active Exploitation, Researchers Warn\nhttps://www.securityweek.com/critical-gitea-flaw-under-active-exploitation-researchers-warn/\n\nAttackers are exploiting the critical Gitea vulnerability CVE-2026-20896 to bypass authentication with a single HTTP header and access vulnerable repositories and secrets.\nThe post Critical Gitea Flaw Under Active Exploitation, Researchers Warn (https://www.securityweek.com/critical-gitea-flaw-under-active-exploitation-researchers-warn/) appeared first on SecurityWeek (https://www.securityweek.com/).", "creation_timestamp": "2026-07-16T00:00:08.523982Z"}, {"uuid": "86fe0ab4-53c3-4e98-a22b-1f3c7484284a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "exploited", "source": "https://t.me/thehackernews/9422", "content": "\ud83d\udea8 CVE-2026-20896 saw its first in-the-wild attempt 13 days after disclosure.\n\nThe Gitea Docker flaw lets reachable containers trust spoofed X-WEBAUTH-USER headers when reverse proxy auth is enabled.\n\nSee which setups are exposed and where the probe stopped: https://thehackernews.com/2026/07/threat-actors-probe-gitea-docker-flaw.html", "creation_timestamp": "2026-07-16T00:00:19.731481Z"}, {"uuid": "cc7794f6-6fc0-441c-96ea-a37c5853769e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://t.me/GithubRedTeam/93701", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-20896\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a XaocZenon\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-16 13:59:08\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nthis is a modified POC of rz1027 for CVE-2026-20896\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-16T15:00:03.657183Z"}, {"uuid": "f576ad9a-5bb3-4e99-9250-64cefcdf055b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "Telegram/CnEki5hq44Oxm0CoGoLc7kB7HOehG1kiHXYcZhaPM81wL2c", "content": "", "creation_timestamp": "2026-07-16T19:00:21.302120Z"}, {"uuid": "701b7bbc-920f-486b-96a3-f344ce748c27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "Telegram/Ar6VYUXodzKxiDS_suM4v32kyWX2cdNc6MzI7nJflxEqdTk", "content": "", "creation_timestamp": "2026-07-16T19:00:17.537820Z"}, {"uuid": "638d7877-149f-493a-90f7-eb2107404b0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "Telegram/7rIIDruJxEl38qBzoHyGM9oWQAxjhN2Km_TAbaElw9hJXAI", "content": "", "creation_timestamp": "2026-07-16T19:00:21.433254Z"}, {"uuid": "c2bb21bb-cb59-44f7-ac53-3e92ec2e7801", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "Telegram/TB3sUB_uu5WF_jRq8K66TTyRIaSSs7xyuOpmS1TasPtzRF4", "content": "", "creation_timestamp": "2026-07-16T19:00:24.948029Z"}, {"uuid": "b6091578-bbc9-4411-93cb-2015834ad1e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "Telegram/CnEki5hq44Oxm0CoGoLc7kB7HOehG1kiHXYcZhaPM81wL2c", "content": "", "creation_timestamp": "2026-07-17T00:00:37.723414Z"}, {"uuid": "d333b895-1b53-4b6e-a45b-6af4917022e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "Telegram/7rIIDruJxEl38qBzoHyGM9oWQAxjhN2Km_TAbaElw9hJXAI", "content": "", "creation_timestamp": "2026-07-17T00:00:37.851384Z"}, {"uuid": "d254defd-d7bc-44ed-aaf5-8b73397b96e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "Telegram/Ar6VYUXodzKxiDS_suM4v32kyWX2cdNc6MzI7nJflxEqdTk", "content": "", "creation_timestamp": "2026-07-17T01:00:15.466174Z"}, {"uuid": "d8100755-9ac5-4ff6-b377-6ccec5bc3397", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "Telegram/TB3sUB_uu5WF_jRq8K66TTyRIaSSs7xyuOpmS1TasPtzRF4", "content": "", "creation_timestamp": "2026-07-17T00:00:41.163521Z"}, {"uuid": "13b69882-7e60-4149-9ebe-ae723f37ed04", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/93701", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-20896\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a XaocZenon\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-16 13:59:08\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nthis is a modified POC of rz1027 for CVE-2026-20896\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-17T00:00:51.999827Z"}, {"uuid": "4088baa2-4d5f-411e-941c-012b8c0ac4f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "published-proof-of-concept", "source": "Telegram/TB3sUB_uu5WF_jRq8K66TTyRIaSSs7xyuOpmS1TasPtzRF4", "content": "", "creation_timestamp": "2026-07-18T00:00:10.050647Z"}, {"uuid": "9b07067e-76d3-4763-974e-3f2c5dd9fb95", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "published-proof-of-concept", "source": "Telegram/Ar6VYUXodzKxiDS_suM4v32kyWX2cdNc6MzI7nJflxEqdTk", "content": "", "creation_timestamp": "2026-07-18T00:00:26.512074Z"}, {"uuid": "90c31f31-094e-496d-a4c3-600486154646", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "published-proof-of-concept", "source": "Telegram/CnEki5hq44Oxm0CoGoLc7kB7HOehG1kiHXYcZhaPM81wL2c", "content": "", "creation_timestamp": "2026-07-18T00:00:22.741751Z"}, {"uuid": "f15361f7-9807-4b14-8df6-c15309c7c37f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "published-proof-of-concept", "source": "Telegram/7rIIDruJxEl38qBzoHyGM9oWQAxjhN2Km_TAbaElw9hJXAI", "content": "", "creation_timestamp": "2026-07-18T00:00:22.823375Z"}, {"uuid": "4a049c46-2118-4ba1-9566-f050b4fc85b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "Telegram/Xr3h-QZd7nLUl6cH2ZkYAyeJW2qp_-enFsFogeXUHPpGcg", "content": "", "creation_timestamp": "2026-07-18T13:00:04.487472Z"}, {"uuid": "a7b42857-6ef0-44f7-8c26-f2dac6516c47", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "exploited", "source": "Telegram/Xr3h-QZd7nLUl6cH2ZkYAyeJW2qp_-enFsFogeXUHPpGcg", "content": "", "creation_timestamp": "2026-07-19T00:00:27.597100Z"}, {"uuid": "d4a484e6-17c0-4ac0-acb2-39a98aa3fe1d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://t.me/MalaysiaHacktivistz/22841", "content": "Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure \u2013 thehackernews.com\n\nTue, 07 Jul 2026 00:28:59", "creation_timestamp": "2026-07-19T16:00:04.656337Z"}, {"uuid": "879e9741-c635-4b21-8a19-329e2e3d8df6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "exploited", "source": "https://t.me/MalaysiaHacktivistz/22841", "content": "Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure \u2013 thehackernews.com\n\nTue, 07 Jul 2026 00:28:59", "creation_timestamp": "2026-07-20T00:00:22.602053Z"}, {"uuid": "e12161ad-f58e-4b32-97e9-4c7da745a8ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "Telegram/QkQGfXHJmhlUJ4Ok72ZW64yVSosDBVIcN9uDsRFq_Gn2BWo", "content": "", "creation_timestamp": "2026-07-20T18:00:12.950855Z"}, {"uuid": "15fb8aff-9a8d-4541-ae8f-145253ccb10e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "Telegram/hIPenhe-vO-uZm0FZ9_PgTXttBSRhFyvx9XOlO5pcs6kI4c", "content": "", "creation_timestamp": "2026-07-20T18:00:13.217905Z"}, {"uuid": "7df7c430-99f0-4c8a-b9f0-123d1c39490a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "Telegram/QkQGfXHJmhlUJ4Ok72ZW64yVSosDBVIcN9uDsRFq_Gn2BWo", "content": "", "creation_timestamp": "2026-07-21T00:00:35.599273Z"}, {"uuid": "b58d12a5-b295-45e7-b8d8-ebff68d1d6e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "Telegram/hIPenhe-vO-uZm0FZ9_PgTXttBSRhFyvx9XOlO5pcs6kI4c", "content": "", "creation_timestamp": "2026-07-21T00:00:36.097957Z"}, {"uuid": "6a04099e-95c1-4e5a-a6e5-4429e1dc8fd4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-20896", "type": "published-proof-of-concept", "source": "https://github.com/go-gitea/gitea/security/advisories/GHSA-f75j-4cw6-rmx4", "content": "", "creation_timestamp": "2026-07-21T22:36:58.280570Z"}, {"uuid": "48a9c1d6-43df-4058-964d-e94b00a48ca9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "published-proof-of-concept", "source": "Telegram/QkQGfXHJmhlUJ4Ok72ZW64yVSosDBVIcN9uDsRFq_Gn2BWo", "content": "", "creation_timestamp": "2026-07-22T00:00:03.965954Z"}, {"uuid": "b1e01fdc-6424-4049-b8dd-fcce08ebcddf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "published-proof-of-concept", "source": "Telegram/hIPenhe-vO-uZm0FZ9_PgTXttBSRhFyvx9XOlO5pcs6kI4c", "content": "", "creation_timestamp": "2026-07-22T00:00:03.594838Z"}, {"uuid": "a400bc43-8296-4255-8c89-83ecce57a871", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-20896", "type": "seen", "source": "https://bsky.app/profile/etairos-ai.bsky.social/post/3mraw36unbi2l", "content": "One HTTP header is all it takes: CVE-2026-20896, a critical auth bypass in Gitea Docker images, is under active exploitation. Full admin, no credentials. Patch now. #ThreatIntel #CyberSecurity\nhttps://threat-intelligence.redeyesecurity.com/blog/gitea-docker-auth-bypass-cve-2026-20896-exploited-2026", "creation_timestamp": "2026-07-22T18:07:14.781185Z"}]}