{"vulnerability": "cve-2026-20896", "sightings": [{"uuid": "7a4dc540-9aff-48e9-ae9f-c03f95340ae6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://t.me/cyberok_news/237", "content": "\ud83d\udcc2 \u041e\u0434\u0438\u043d \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043e\u043a \u2014 \u0438 \u0442\u044b \u0430\u0434\u043c\u0438\u043d. \u041e\u0431\u0445\u043e\u0434 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 Gitea\n\n\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-20896 \u0432 Gitea \u2014 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 \u0441 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c \u043a\u043e\u0434\u043e\u043c \u0434\u043b\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u043d\u044b\u0445 Git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 \u2014 \u0431\u044b\u043b\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0440\u0435\u043b\u0438\u0437\u0435 1.26.3 \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u0439 \u043f\u043e\u043b\u043e\u0432\u0438\u043d\u0435 \u0438\u044e\u043d\u044f 2026 \u0433\u043e\u0434\u0430 \u043f\u043e\u0441\u043b\u0435 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f rz1027. CVE-\u043d\u043e\u043c\u0435\u0440 \u0431\u044b\u043b \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d \u043f\u043e\u0437\u0436\u0435, 3 \u0438\u044e\u043b\u044f. \n\n\ud83d\udce1 \u0421\u041a\u0418\u041f\u0410 \u0444\u0438\u043a\u0441\u0438\u0440\u0443\u0435\u0442 \u043e\u043a\u043e\u043b\u043e 22 900 \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u044b\u0445 \u0445\u043e\u0441\u0442\u043e\u0432 \u0441 Gitea, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0438\u0437\u0432\u043d\u0435. \u0418\u0437 \u043d\u0438\u0445 83% \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b CVE-2026-20896. \n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0441 \u0441\u0435\u0442\u0435\u0432\u044b\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u0432\u044b\u0434\u0430\u0442\u044c \u0441\u0435\u0431\u044f \u0437\u0430 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0430 \u043f\u0440\u0438 \u0432\u043a\u043b\u044e\u0447\u0451\u043d\u043d\u043e\u0439 \u0430\u0432\u0442\u043e-\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u0438 \u2014 \u0437\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0435 \u0438\u043c\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0447\u0435\u0440\u0435\u0437 HTTP-\u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043e\u043a X-WEBAUTH-USER \u043f\u0440\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u043e\u0439 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435  \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 \u043e\u0431\u0440\u0430\u0442\u043d\u044b\u0439 \u043f\u0440\u043e\u043a\u0441\u0438 (reverse-proxy).\n\n\u0414\u043b\u044f \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0439 \u0430\u0442\u0430\u043a\u0438 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f: Gitea \u0434\u043e\u043b\u0436\u0435\u043d \u0431\u044b\u0442\u044c \u0440\u0430\u0437\u0432\u0451\u0440\u043d\u0443\u0442 \u0447\u0435\u0440\u0435\u0437 Docker-\u043e\u0431\u0440\u0430\u0437 \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u043c\u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u043c\u0438 \u0438 \u0432\u043a\u043b\u044e\u0447\u0451\u043d\u043d\u043e\u0439 reverse-proxy \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0435\u0439. \u042d\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u0432\u043b\u0438\u044f\u0442\u044c \u043d\u0430 \u0438\u0442\u043e\u0433\u043e\u0432\u043e\u0435 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0440\u0435\u0430\u043b\u044c\u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0445\u043e\u0441\u0442\u043e\u0432. \u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0421\u041a\u0418\u041f\u0410 PentOps \u0441\u0432\u043e\u0435\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u044b.\n\n\ud83d\udd27 \u041c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0442\u0435\u043c, \u0447\u0442\u043e \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 Docker-\u043e\u0431\u0440\u0430\u0437\u044b Gitea \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 1.26.3 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u043d\u0435\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e:\n\nREVERSE_PROXY_TRUSTED_PROXIES = *\n\n\u041f\u0440\u0438 \u0432\u043a\u043b\u044e\u0447\u0451\u043d\u043d\u043e\u0439 reverse-proxy \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 (ENABLE_REVERSE_PROXY_AUTHENTICATION = true) Gitea \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442 \u0434\u043e\u0432\u0435\u0440\u044f\u0442\u044c \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0443 X-WEBAUTH-USER \u043e\u0442 \u043b\u044e\u0431\u043e\u0433\u043e IP-\u0430\u0434\u0440\u0435\u0441\u0430, \u0430 \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u043e\u0442 \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u043e\u0433\u043e reverse proxy. \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u044b\u043c \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435\u043c \u0441\u0447\u0438\u0442\u0430\u0435\u0442\u0441\u044f 127.0.0.0/8,::1/128, \u0442\u043e \u0435\u0441\u0442\u044c \u0434\u043e\u0432\u0435\u0440\u0438\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u043a \u0430\u0434\u0440\u0435\u0441\u0430\u043c \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0439 \u0441\u0432\u044f\u0437\u0438 (loopback-\u0430\u0434\u0440\u0435\u0441\u0430). \u0418\u043c\u0435\u043d\u043d\u043e \u044d\u0442\u043e \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u0432 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u043c \u0448\u0430\u0431\u043b\u043e\u043d\u0435 Docker app.ini \u0431\u044b\u043b\u043e \u0437\u0430\u043c\u0435\u043d\u0435\u043d\u043e \u043d\u0430 \u0448\u0430\u0431\u043b\u043e\u043d \u0441 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u0435\u043c \u0434\u043b\u044f \u0432\u0441\u0435\u0445 \u0430\u0434\u0440\u0435\u0441\u043e\u0432.\n\n\u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0437\u0430\u043f\u0440\u043e\u0441 \u0441 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u043c \u0432\u0438\u0434\u0430 X-WEBAUTH-USER:  \u0438 \u0431\u044b\u0442\u044c \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u043a\u0430\u043a \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u044b\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437 \u043f\u0430\u0440\u043e\u043b\u044f, \u0442\u043e\u043a\u0435\u043d\u0430 \u0438\u043b\u0438 \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0439 \u0441\u0435\u0441\u0441\u0438\u0438. \u0415\u0441\u043b\u0438 \u0432 Gitea \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0430 \u0430\u0432\u0442\u043e-\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u044f, \u0430\u043a\u043a\u0430\u0443\u043d\u0442 \u0441 \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u044b\u043c \u0438\u043c\u0435\u043d\u0435\u043c \u0441\u043e\u0437\u0434\u0430\u0451\u0442\u0441\u044f \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u2014 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u043d\u0435 \u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u0437\u043d\u0430\u0442\u044c \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u043b\u043e\u0433\u0438\u043d, \u043e\u043d \u043c\u043e\u0436\u0435\u0442 \u0443\u043a\u0430\u0437\u0430\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0435 \u0438\u043c\u044f. \u041d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u043e\u043f\u0430\u0441\u043d\u044b\u0439 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0439 \u2014 \u0443\u0441\u043f\u0435\u0448\u043d\u044b\u0439 \u0432\u0445\u043e\u0434 \u043f\u043e\u0434 \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u044c\u044e \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430.\n\n\u2757\ufe0f\u0412\u0430\u0436\u043d\u043e\u0435 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435: \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u0430 \u0442\u043e\u043b\u044c\u043a\u043e \u0447\u0435\u0440\u0435\u0437 \u0432\u0435\u0431-\u0441\u0435\u0430\u043d\u0441, \u0430 \u043d\u0435 \u0447\u0435\u0440\u0435\u0437 API \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u0442\u043e\u043a\u0435\u043d\u043e\u0432 (/api/v1/...). \u042d\u0442\u043e\u0442 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 \u0438\u0433\u043d\u043e\u0440\u0438\u0440\u0443\u0435\u0442 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043e\u043a X-WEBAUTH-USER \u0438 \u043d\u0435 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438.\n\n\ud83d\udca5 \u041e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438\n\u0417\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u043e\u0435 \u041f\u041e: \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 Docker-\u043e\u0431\u0440\u0430\u0437\u044b Gitea \u0434\u043e 1.26.3. \u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043e 1.26.4 \u0438\u043b\u0438 \u043d\u043e\u0432\u0435\u0435 \u0438\u0437-\u0437\u0430 \u0440\u0435\u0433\u0440\u0435\u0441\u0441\u0438\u0438 \u0432 1.26.3.\n\u0422\u0438\u043f: \u041e\u0431\u0445\u043e\u0434 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 / Impersonation\n\u041a\u043b\u0430\u0441\u0441\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f: CWE-284 (Improper Access Control)\n\ud83d\udd3bCVSS 3.1: 9.8 \u2014 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n\n\ud83d\udd0d \u0418\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0430\u0442\u0430\u043a\u0438\n\u2022 \u0417\u0430\u043f\u0440\u043e\u0441\u044b \u043a Gitea \u0441 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u043c X-WEBAUTH-USER \u043e\u0442 \u043d\u0435\u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0445 IP-\u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u0447\u0435\u0440\u0435\u0437 \u0432\u0435\u0431-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441.\n\u2022 \u0410\u043d\u043e\u043c\u0430\u043b\u044c\u043d\u044b\u0435 \u0432\u0445\u043e\u0434\u044b \u0432 \u0443\u0447\u0451\u0442\u043d\u044b\u0435 \u0437\u0430\u043f\u0438\u0441\u0438 \u0431\u0435\u0437 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0439 \u043f\u0440\u043e\u0446\u0435\u0434\u0443\u0440\u044b \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.\n\u2022 \u041d\u0435\u043e\u0436\u0438\u0434\u0430\u043d\u043d\u0430\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439.\n\u2022 \u041f\u043e\u044f\u0432\u043b\u0435\u043d\u0438\u0435 \u043d\u043e\u0432\u044b\u0445 \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u2014 \u043f\u0440\u0438\u0437\u043d\u0430\u043a \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 \u0430\u0432\u0442\u043e-\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u044e.\n\u2022 \u0421\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u0438\u043b\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u043a\u043b\u044e\u0447\u0435\u0439 SSH, \u043a\u043b\u044e\u0447\u0435\u0439 \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u0432\u0435\u0431-\u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0447\u0438\u043a\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u0435\u0439 \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043a \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f.\n\u2022 \u041f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u043a \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u044b\u043c \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u043c \u043f\u043e\u0441\u043b\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0441 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0430\u043c\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0447\u0435\u0440\u0435\u0437  reverse proxy.\n\n\ud83d\udee1 \u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u043e \u0437\u0430\u0449\u0438\u0442\u0435\n1. \u041e\u0431\u043d\u043e\u0432\u0438\u0442\u044c Gitea \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 1.26.4 \u0438\u043b\u0438 \u043d\u043e\u0432\u0435\u0435. \n\n2. \u041f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e reverse-proxy \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.\n\u0415\u0441\u043b\u0438 \u043e\u043d\u0430 \u043d\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u2014 \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c ENABLE_REVERSE_PROXY_AUTHENTICATION.\n\n3. \u041e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0442\u044c \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0435 proxy-\u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438.\n\u0417\u0430\u043c\u0435\u043d\u0438\u0442\u0435 REVERSE_PROXY_TRUSTED_PROXIES = * \u043d\u0430 \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u044b\u0435 IP-\u0430\u0434\u0440\u0435\u0441\u0430 \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0445 reverse proxy.\n\n4. \u041e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0430\u0432\u0442\u043e-\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u044e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u0435\u0441\u043b\u0438 \u043e\u043d\u0430 \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f.\n\n5. \u0417\u0430\u043f\u0440\u0435\u0442\u0438\u0442\u044c \u043f\u0440\u044f\u043c\u043e\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a Gitea \u0432 \u043e\u0431\u0445\u043e\u0434 reverse proxy. \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u044d\u043a\u0440\u0430\u043d, \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u044e \u0441\u0435\u0442\u0435\u0439 Docker, \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u0443\u044e \u0447\u0430\u0441\u0442\u043d\u0443\u044e \u0441\u0435\u0442\u044c \u0438\u043b\u0438 \u0441\u043f\u0438\u0441\u043e\u043a \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u043d\u044b\u0445 IP-\u0430\u0434\u0440\u0435\u0441\u043e\u0432.\n\n6. \u041f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u0436\u0443\u0440\u043d\u0430\u043b\u044b \u043d\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0441 X-WEBAUTH-USER \u043e\u0442 \u043d\u0435\u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0445 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u0432 \u0437\u0430 \u043f\u0435\u0440\u0438\u043e\u0434 \u0441 \u043c\u043e\u043c\u0435\u043d\u0442\u0430 \u0432\u044b\u0445\u043e\u0434\u0430 \u043f\u0430\u0442\u0447\u0430 (20-\u0435 \u0447\u0438\u0441\u043b\u0430 \u0438\u044e\u043d\u044f 2026).\n\n7. \u041e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0439 \u0431\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044c \u0432\u0435\u043d\u0434\u043e\u0440\u0430.", "creation_timestamp": "2026-08-04T13:00:18.857487Z"}, {"uuid": "a6dbd7f0-f6a2-423e-95c8-48612beba132", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://t.me/cyberok_news/237", "content": "\ud83d\udcc2 \u041e\u0434\u0438\u043d \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043e\u043a \u2014 \u0438 \u0442\u044b \u0430\u0434\u043c\u0438\u043d. \u041e\u0431\u0445\u043e\u0434 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 Gitea\n\n\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-20896 \u0432 Gitea \u2014 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 \u0441 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c \u043a\u043e\u0434\u043e\u043c \u0434\u043b\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u043d\u044b\u0445 Git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 \u2014 \u0431\u044b\u043b\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0440\u0435\u043b\u0438\u0437\u0435 1.26.3 \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u0439 \u043f\u043e\u043b\u043e\u0432\u0438\u043d\u0435 \u0438\u044e\u043d\u044f 2026 \u0433\u043e\u0434\u0430 \u043f\u043e\u0441\u043b\u0435 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f rz1027. CVE-\u043d\u043e\u043c\u0435\u0440 \u0431\u044b\u043b \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d \u043f\u043e\u0437\u0436\u0435, 3 \u0438\u044e\u043b\u044f. \n\n\ud83d\udce1 \u0421\u041a\u0418\u041f\u0410 \u0444\u0438\u043a\u0441\u0438\u0440\u0443\u0435\u0442 \u043e\u043a\u043e\u043b\u043e 22 900 \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u044b\u0445 \u0445\u043e\u0441\u0442\u043e\u0432 \u0441 Gitea, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0438\u0437\u0432\u043d\u0435. \u0418\u0437 \u043d\u0438\u0445 83% \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b CVE-2026-20896. \n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0441 \u0441\u0435\u0442\u0435\u0432\u044b\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u0432\u044b\u0434\u0430\u0442\u044c \u0441\u0435\u0431\u044f \u0437\u0430 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0430 \u043f\u0440\u0438 \u0432\u043a\u043b\u044e\u0447\u0451\u043d\u043d\u043e\u0439 \u0430\u0432\u0442\u043e-\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u0438 \u2014 \u0437\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0435 \u0438\u043c\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0447\u0435\u0440\u0435\u0437 HTTP-\u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043e\u043a X-WEBAUTH-USER \u043f\u0440\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u043e\u0439 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435  \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 \u043e\u0431\u0440\u0430\u0442\u043d\u044b\u0439 \u043f\u0440\u043e\u043a\u0441\u0438 (reverse-proxy).\n\n\u0414\u043b\u044f \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0439 \u0430\u0442\u0430\u043a\u0438 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f: Gitea \u0434\u043e\u043b\u0436\u0435\u043d \u0431\u044b\u0442\u044c \u0440\u0430\u0437\u0432\u0451\u0440\u043d\u0443\u0442 \u0447\u0435\u0440\u0435\u0437 Docker-\u043e\u0431\u0440\u0430\u0437 \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u043c\u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u043c\u0438 \u0438 \u0432\u043a\u043b\u044e\u0447\u0451\u043d\u043d\u043e\u0439 reverse-proxy \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0435\u0439. \u042d\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u0432\u043b\u0438\u044f\u0442\u044c \u043d\u0430 \u0438\u0442\u043e\u0433\u043e\u0432\u043e\u0435 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0440\u0435\u0430\u043b\u044c\u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0445\u043e\u0441\u0442\u043e\u0432. \u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0421\u041a\u0418\u041f\u0410 PentOps \u0441\u0432\u043e\u0435\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u044b.\n\n\ud83d\udd27 \u041c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0442\u0435\u043c, \u0447\u0442\u043e \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 Docker-\u043e\u0431\u0440\u0430\u0437\u044b Gitea \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 1.26.3 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u043d\u0435\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e:\n\nREVERSE_PROXY_TRUSTED_PROXIES = *\n\n\u041f\u0440\u0438 \u0432\u043a\u043b\u044e\u0447\u0451\u043d\u043d\u043e\u0439 reverse-proxy \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 (ENABLE_REVERSE_PROXY_AUTHENTICATION = true) Gitea \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442 \u0434\u043e\u0432\u0435\u0440\u044f\u0442\u044c \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0443 X-WEBAUTH-USER \u043e\u0442 \u043b\u044e\u0431\u043e\u0433\u043e IP-\u0430\u0434\u0440\u0435\u0441\u0430, \u0430 \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u043e\u0442 \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u043e\u0433\u043e reverse proxy. \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u044b\u043c \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435\u043c \u0441\u0447\u0438\u0442\u0430\u0435\u0442\u0441\u044f 127.0.0.0/8,::1/128, \u0442\u043e \u0435\u0441\u0442\u044c \u0434\u043e\u0432\u0435\u0440\u0438\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u043a \u0430\u0434\u0440\u0435\u0441\u0430\u043c \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0439 \u0441\u0432\u044f\u0437\u0438 (loopback-\u0430\u0434\u0440\u0435\u0441\u0430). \u0418\u043c\u0435\u043d\u043d\u043e \u044d\u0442\u043e \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u0432 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u043c \u0448\u0430\u0431\u043b\u043e\u043d\u0435 Docker app.ini \u0431\u044b\u043b\u043e \u0437\u0430\u043c\u0435\u043d\u0435\u043d\u043e \u043d\u0430 \u0448\u0430\u0431\u043b\u043e\u043d \u0441 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u0435\u043c \u0434\u043b\u044f \u0432\u0441\u0435\u0445 \u0430\u0434\u0440\u0435\u0441\u043e\u0432.\n\n\u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0437\u0430\u043f\u0440\u043e\u0441 \u0441 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u043c \u0432\u0438\u0434\u0430 X-WEBAUTH-USER:  \u0438 \u0431\u044b\u0442\u044c \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u043a\u0430\u043a \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u044b\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437 \u043f\u0430\u0440\u043e\u043b\u044f, \u0442\u043e\u043a\u0435\u043d\u0430 \u0438\u043b\u0438 \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0439 \u0441\u0435\u0441\u0441\u0438\u0438. \u0415\u0441\u043b\u0438 \u0432 Gitea \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0430 \u0430\u0432\u0442\u043e-\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u044f, \u0430\u043a\u043a\u0430\u0443\u043d\u0442 \u0441 \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u044b\u043c \u0438\u043c\u0435\u043d\u0435\u043c \u0441\u043e\u0437\u0434\u0430\u0451\u0442\u0441\u044f \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u2014 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u043d\u0435 \u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u0437\u043d\u0430\u0442\u044c \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u043b\u043e\u0433\u0438\u043d, \u043e\u043d \u043c\u043e\u0436\u0435\u0442 \u0443\u043a\u0430\u0437\u0430\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0435 \u0438\u043c\u044f. \u041d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u043e\u043f\u0430\u0441\u043d\u044b\u0439 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0439 \u2014 \u0443\u0441\u043f\u0435\u0448\u043d\u044b\u0439 \u0432\u0445\u043e\u0434 \u043f\u043e\u0434 \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u044c\u044e \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430.\n\n\u2757\ufe0f\u0412\u0430\u0436\u043d\u043e\u0435 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435: \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u0430 \u0442\u043e\u043b\u044c\u043a\u043e \u0447\u0435\u0440\u0435\u0437 \u0432\u0435\u0431-\u0441\u0435\u0430\u043d\u0441, \u0430 \u043d\u0435 \u0447\u0435\u0440\u0435\u0437 API \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u0442\u043e\u043a\u0435\u043d\u043e\u0432 (/api/v1/...). \u042d\u0442\u043e\u0442 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 \u0438\u0433\u043d\u043e\u0440\u0438\u0440\u0443\u0435\u0442 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043e\u043a X-WEBAUTH-USER \u0438 \u043d\u0435 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438.\n\n\ud83d\udca5 \u041e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438\n\u0417\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u043e\u0435 \u041f\u041e: \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 Docker-\u043e\u0431\u0440\u0430\u0437\u044b Gitea \u0434\u043e 1.26.3. \u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043e 1.26.4 \u0438\u043b\u0438 \u043d\u043e\u0432\u0435\u0435 \u0438\u0437-\u0437\u0430 \u0440\u0435\u0433\u0440\u0435\u0441\u0441\u0438\u0438 \u0432 1.26.3.\n\u0422\u0438\u043f: \u041e\u0431\u0445\u043e\u0434 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 / Impersonation\n\u041a\u043b\u0430\u0441\u0441\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f: CWE-284 (Improper Access Control)\n\ud83d\udd3bCVSS 3.1: 9.8 \u2014 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n\n\ud83d\udd0d \u0418\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0430\u0442\u0430\u043a\u0438\n\u2022 \u0417\u0430\u043f\u0440\u043e\u0441\u044b \u043a Gitea \u0441 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u043c X-WEBAUTH-USER \u043e\u0442 \u043d\u0435\u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0445 IP-\u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u0447\u0435\u0440\u0435\u0437 \u0432\u0435\u0431-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441.\n\u2022 \u0410\u043d\u043e\u043c\u0430\u043b\u044c\u043d\u044b\u0435 \u0432\u0445\u043e\u0434\u044b \u0432 \u0443\u0447\u0451\u0442\u043d\u044b\u0435 \u0437\u0430\u043f\u0438\u0441\u0438 \u0431\u0435\u0437 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0439 \u043f\u0440\u043e\u0446\u0435\u0434\u0443\u0440\u044b \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.\n\u2022 \u041d\u0435\u043e\u0436\u0438\u0434\u0430\u043d\u043d\u0430\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439.\n\u2022 \u041f\u043e\u044f\u0432\u043b\u0435\u043d\u0438\u0435 \u043d\u043e\u0432\u044b\u0445 \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u2014 \u043f\u0440\u0438\u0437\u043d\u0430\u043a \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 \u0430\u0432\u0442\u043e-\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u044e.\n\u2022 \u0421\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u0438\u043b\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u043a\u043b\u044e\u0447\u0435\u0439 SSH, \u043a\u043b\u044e\u0447\u0435\u0439 \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u0432\u0435\u0431-\u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0447\u0438\u043a\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u0435\u0439 \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043a \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f.\n\u2022 \u041f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u043a \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u044b\u043c \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u043c \u043f\u043e\u0441\u043b\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0441 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0430\u043c\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0447\u0435\u0440\u0435\u0437  reverse proxy.\n\n\ud83d\udee1 \u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u043e \u0437\u0430\u0449\u0438\u0442\u0435\n1. \u041e\u0431\u043d\u043e\u0432\u0438\u0442\u044c Gitea \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 1.26.4 \u0438\u043b\u0438 \u043d\u043e\u0432\u0435\u0435. \n\n2. \u041f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e reverse-proxy \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.\n\u0415\u0441\u043b\u0438 \u043e\u043d\u0430 \u043d\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u2014 \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c ENABLE_REVERSE_PROXY_AUTHENTICATION.\n\n3. \u041e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0442\u044c \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0435 proxy-\u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438.\n\u0417\u0430\u043c\u0435\u043d\u0438\u0442\u0435 REVERSE_PROXY_TRUSTED_PROXIES = * \u043d\u0430 \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u044b\u0435 IP-\u0430\u0434\u0440\u0435\u0441\u0430 \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0445 reverse proxy.\n\n4. \u041e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0430\u0432\u0442\u043e-\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u044e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u0435\u0441\u043b\u0438 \u043e\u043d\u0430 \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f.\n\n5. \u0417\u0430\u043f\u0440\u0435\u0442\u0438\u0442\u044c \u043f\u0440\u044f\u043c\u043e\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a Gitea \u0432 \u043e\u0431\u0445\u043e\u0434 reverse proxy. \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u044d\u043a\u0440\u0430\u043d, \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u044e \u0441\u0435\u0442\u0435\u0439 Docker, \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u0443\u044e \u0447\u0430\u0441\u0442\u043d\u0443\u044e \u0441\u0435\u0442\u044c \u0438\u043b\u0438 \u0441\u043f\u0438\u0441\u043e\u043a \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u043d\u044b\u0445 IP-\u0430\u0434\u0440\u0435\u0441\u043e\u0432.\n\n6. \u041f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u0436\u0443\u0440\u043d\u0430\u043b\u044b \u043d\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0441 X-WEBAUTH-USER \u043e\u0442 \u043d\u0435\u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0445 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u0432 \u0437\u0430 \u043f\u0435\u0440\u0438\u043e\u0434 \u0441 \u043c\u043e\u043c\u0435\u043d\u0442\u0430 \u0432\u044b\u0445\u043e\u0434\u0430 \u043f\u0430\u0442\u0447\u0430 (20-\u0435 \u0447\u0438\u0441\u043b\u0430 \u0438\u044e\u043d\u044f 2026).\n\n7. \u041e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0439 \u0431\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044c \u0432\u0435\u043d\u0434\u043e\u0440\u0430.", "creation_timestamp": "2026-08-05T00:00:35.432244Z"}, {"uuid": "ec2de4b9-53c6-4f10-a9e7-c9ea22b6f9bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "Telegram/wffTTuVgQJ98JwhL42Ct7GiTcbOZOW8KxITp_kb-2yHdqmI", "content": "", "creation_timestamp": "2026-08-21T09:00:04.660546Z"}, {"uuid": "37ebbf05-42ed-4550-b612-a5e861c7c9ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "published-proof-of-concept", "source": "https://t.me/cyberok_news/237", "content": "\ud83d\udcc2 \u041e\u0434\u0438\u043d \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043e\u043a \u2014 \u0438 \u0442\u044b \u0430\u0434\u043c\u0438\u043d. \u041e\u0431\u0445\u043e\u0434 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 Gitea\n\n\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-20896 \u0432 Gitea \u2014 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 \u0441 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c \u043a\u043e\u0434\u043e\u043c \u0434\u043b\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u043d\u044b\u0445 Git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 \u2014 \u0431\u044b\u043b\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0440\u0435\u043b\u0438\u0437\u0435 1.26.3 \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u0439 \u043f\u043e\u043b\u043e\u0432\u0438\u043d\u0435 \u0438\u044e\u043d\u044f 2026 \u0433\u043e\u0434\u0430 \u043f\u043e\u0441\u043b\u0435 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f rz1027. CVE-\u043d\u043e\u043c\u0435\u0440 \u0431\u044b\u043b \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d \u043f\u043e\u0437\u0436\u0435, 3 \u0438\u044e\u043b\u044f. \n\n\ud83d\udce1 \u0421\u041a\u0418\u041f\u0410 \u0444\u0438\u043a\u0441\u0438\u0440\u0443\u0435\u0442 \u043e\u043a\u043e\u043b\u043e 22 900 \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u044b\u0445 \u0445\u043e\u0441\u0442\u043e\u0432 \u0441 Gitea, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0438\u0437\u0432\u043d\u0435. \u0418\u0437 \u043d\u0438\u0445 83% \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b CVE-2026-20896. \n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0441 \u0441\u0435\u0442\u0435\u0432\u044b\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u0432\u044b\u0434\u0430\u0442\u044c \u0441\u0435\u0431\u044f \u0437\u0430 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0430 \u043f\u0440\u0438 \u0432\u043a\u043b\u044e\u0447\u0451\u043d\u043d\u043e\u0439 \u0430\u0432\u0442\u043e-\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u0438 \u2014 \u0437\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0435 \u0438\u043c\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0447\u0435\u0440\u0435\u0437 HTTP-\u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043e\u043a X-WEBAUTH-USER \u043f\u0440\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u043e\u0439 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435  \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 \u043e\u0431\u0440\u0430\u0442\u043d\u044b\u0439 \u043f\u0440\u043e\u043a\u0441\u0438 (reverse-proxy).\n\n\u0414\u043b\u044f \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0439 \u0430\u0442\u0430\u043a\u0438 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f: Gitea \u0434\u043e\u043b\u0436\u0435\u043d \u0431\u044b\u0442\u044c \u0440\u0430\u0437\u0432\u0451\u0440\u043d\u0443\u0442 \u0447\u0435\u0440\u0435\u0437 Docker-\u043e\u0431\u0440\u0430\u0437 \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u043c\u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u043c\u0438 \u0438 \u0432\u043a\u043b\u044e\u0447\u0451\u043d\u043d\u043e\u0439 reverse-proxy \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0435\u0439. \u042d\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u0432\u043b\u0438\u044f\u0442\u044c \u043d\u0430 \u0438\u0442\u043e\u0433\u043e\u0432\u043e\u0435 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u0440\u0435\u0430\u043b\u044c\u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0445\u043e\u0441\u0442\u043e\u0432. \u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0421\u041a\u0418\u041f\u0410 PentOps \u0441\u0432\u043e\u0435\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u044b.\n\n\ud83d\udd27 \u041c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0442\u0435\u043c, \u0447\u0442\u043e \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 Docker-\u043e\u0431\u0440\u0430\u0437\u044b Gitea \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 1.26.3 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u043d\u0435\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e:\n\nREVERSE_PROXY_TRUSTED_PROXIES = *\n\n\u041f\u0440\u0438 \u0432\u043a\u043b\u044e\u0447\u0451\u043d\u043d\u043e\u0439 reverse-proxy \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 (ENABLE_REVERSE_PROXY_AUTHENTICATION = true) Gitea \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442 \u0434\u043e\u0432\u0435\u0440\u044f\u0442\u044c \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0443 X-WEBAUTH-USER \u043e\u0442 \u043b\u044e\u0431\u043e\u0433\u043e IP-\u0430\u0434\u0440\u0435\u0441\u0430, \u0430 \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u043e\u0442 \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u043e\u0433\u043e reverse proxy. \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u044b\u043c \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435\u043c \u0441\u0447\u0438\u0442\u0430\u0435\u0442\u0441\u044f 127.0.0.0/8,::1/128, \u0442\u043e \u0435\u0441\u0442\u044c \u0434\u043e\u0432\u0435\u0440\u0438\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u043a \u0430\u0434\u0440\u0435\u0441\u0430\u043c \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0439 \u0441\u0432\u044f\u0437\u0438 (loopback-\u0430\u0434\u0440\u0435\u0441\u0430). \u0418\u043c\u0435\u043d\u043d\u043e \u044d\u0442\u043e \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u0432 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u043c \u0448\u0430\u0431\u043b\u043e\u043d\u0435 Docker app.ini \u0431\u044b\u043b\u043e \u0437\u0430\u043c\u0435\u043d\u0435\u043d\u043e \u043d\u0430 \u0448\u0430\u0431\u043b\u043e\u043d \u0441 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u0435\u043c \u0434\u043b\u044f \u0432\u0441\u0435\u0445 \u0430\u0434\u0440\u0435\u0441\u043e\u0432.\n\n\u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0437\u0430\u043f\u0440\u043e\u0441 \u0441 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u043c \u0432\u0438\u0434\u0430 X-WEBAUTH-USER:  \u0438 \u0431\u044b\u0442\u044c \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u043a\u0430\u043a \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u044b\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437 \u043f\u0430\u0440\u043e\u043b\u044f, \u0442\u043e\u043a\u0435\u043d\u0430 \u0438\u043b\u0438 \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0439 \u0441\u0435\u0441\u0441\u0438\u0438. \u0415\u0441\u043b\u0438 \u0432 Gitea \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0430 \u0430\u0432\u0442\u043e-\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u044f, \u0430\u043a\u043a\u0430\u0443\u043d\u0442 \u0441 \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u044b\u043c \u0438\u043c\u0435\u043d\u0435\u043c \u0441\u043e\u0437\u0434\u0430\u0451\u0442\u0441\u044f \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u2014 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u043d\u0435 \u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u0437\u043d\u0430\u0442\u044c \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u043b\u043e\u0433\u0438\u043d, \u043e\u043d \u043c\u043e\u0436\u0435\u0442 \u0443\u043a\u0430\u0437\u0430\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0435 \u0438\u043c\u044f. \u041d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u043e\u043f\u0430\u0441\u043d\u044b\u0439 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0439 \u2014 \u0443\u0441\u043f\u0435\u0448\u043d\u044b\u0439 \u0432\u0445\u043e\u0434 \u043f\u043e\u0434 \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u044c\u044e \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430.\n\n\u2757\ufe0f\u0412\u0430\u0436\u043d\u043e\u0435 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435: \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u0430 \u0442\u043e\u043b\u044c\u043a\u043e \u0447\u0435\u0440\u0435\u0437 \u0432\u0435\u0431-\u0441\u0435\u0430\u043d\u0441, \u0430 \u043d\u0435 \u0447\u0435\u0440\u0435\u0437 API \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u0442\u043e\u043a\u0435\u043d\u043e\u0432 (/api/v1/...). \u042d\u0442\u043e\u0442 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 \u0438\u0433\u043d\u043e\u0440\u0438\u0440\u0443\u0435\u0442 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043e\u043a X-WEBAUTH-USER \u0438 \u043d\u0435 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438.\n\n\ud83d\udca5 \u041e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438\n\u0417\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u043e\u0435 \u041f\u041e: \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 Docker-\u043e\u0431\u0440\u0430\u0437\u044b Gitea \u0434\u043e 1.26.3. \u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043e 1.26.4 \u0438\u043b\u0438 \u043d\u043e\u0432\u0435\u0435 \u0438\u0437-\u0437\u0430 \u0440\u0435\u0433\u0440\u0435\u0441\u0441\u0438\u0438 \u0432 1.26.3.\n\u0422\u0438\u043f: \u041e\u0431\u0445\u043e\u0434 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 / Impersonation\n\u041a\u043b\u0430\u0441\u0441\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f: CWE-284 (Improper Access Control)\n\ud83d\udd3bCVSS 3.1: 9.8 \u2014 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n\n\ud83d\udd0d \u0418\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0430\u0442\u0430\u043a\u0438\n\u2022 \u0417\u0430\u043f\u0440\u043e\u0441\u044b \u043a Gitea \u0441 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u043c X-WEBAUTH-USER \u043e\u0442 \u043d\u0435\u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0445 IP-\u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u0447\u0435\u0440\u0435\u0437 \u0432\u0435\u0431-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441.\n\u2022 \u0410\u043d\u043e\u043c\u0430\u043b\u044c\u043d\u044b\u0435 \u0432\u0445\u043e\u0434\u044b \u0432 \u0443\u0447\u0451\u0442\u043d\u044b\u0435 \u0437\u0430\u043f\u0438\u0441\u0438 \u0431\u0435\u0437 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0439 \u043f\u0440\u043e\u0446\u0435\u0434\u0443\u0440\u044b \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.\n\u2022 \u041d\u0435\u043e\u0436\u0438\u0434\u0430\u043d\u043d\u0430\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439.\n\u2022 \u041f\u043e\u044f\u0432\u043b\u0435\u043d\u0438\u0435 \u043d\u043e\u0432\u044b\u0445 \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u2014 \u043f\u0440\u0438\u0437\u043d\u0430\u043a \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 \u0430\u0432\u0442\u043e-\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u044e.\n\u2022 \u0421\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u0438\u043b\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u043a\u043b\u044e\u0447\u0435\u0439 SSH, \u043a\u043b\u044e\u0447\u0435\u0439 \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u0432\u0435\u0431-\u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0447\u0438\u043a\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u0435\u0439 \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043a \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f.\n\u2022 \u041f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u043a \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u044b\u043c \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u043c \u043f\u043e\u0441\u043b\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0441 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0430\u043c\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0447\u0435\u0440\u0435\u0437  reverse proxy.\n\n\ud83d\udee1 \u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u043e \u0437\u0430\u0449\u0438\u0442\u0435\n1. \u041e\u0431\u043d\u043e\u0432\u0438\u0442\u044c Gitea \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 1.26.4 \u0438\u043b\u0438 \u043d\u043e\u0432\u0435\u0435. \n\n2. \u041f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e reverse-proxy \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.\n\u0415\u0441\u043b\u0438 \u043e\u043d\u0430 \u043d\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u2014 \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c ENABLE_REVERSE_PROXY_AUTHENTICATION.\n\n3. \u041e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0442\u044c \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0435 proxy-\u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438.\n\u0417\u0430\u043c\u0435\u043d\u0438\u0442\u0435 REVERSE_PROXY_TRUSTED_PROXIES = * \u043d\u0430 \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u044b\u0435 IP-\u0430\u0434\u0440\u0435\u0441\u0430 \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0445 reverse proxy.\n\n4. \u041e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0430\u0432\u0442\u043e-\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u044e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u0435\u0441\u043b\u0438 \u043e\u043d\u0430 \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f.\n\n5. \u0417\u0430\u043f\u0440\u0435\u0442\u0438\u0442\u044c \u043f\u0440\u044f\u043c\u043e\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a Gitea \u0432 \u043e\u0431\u0445\u043e\u0434 reverse proxy. \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u044d\u043a\u0440\u0430\u043d, \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u044e \u0441\u0435\u0442\u0435\u0439 Docker, \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u0443\u044e \u0447\u0430\u0441\u0442\u043d\u0443\u044e \u0441\u0435\u0442\u044c \u0438\u043b\u0438 \u0441\u043f\u0438\u0441\u043e\u043a \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u043d\u044b\u0445 IP-\u0430\u0434\u0440\u0435\u0441\u043e\u0432.\n\n6. \u041f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u0436\u0443\u0440\u043d\u0430\u043b\u044b \u043d\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0441 X-WEBAUTH-USER \u043e\u0442 \u043d\u0435\u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0445 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u0432 \u0437\u0430 \u043f\u0435\u0440\u0438\u043e\u0434 \u0441 \u043c\u043e\u043c\u0435\u043d\u0442\u0430 \u0432\u044b\u0445\u043e\u0434\u0430 \u043f\u0430\u0442\u0447\u0430 (20-\u0435 \u0447\u0438\u0441\u043b\u0430 \u0438\u044e\u043d\u044f 2026).\n\n7. \u041e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0439 \u0431\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044c \u0432\u0435\u043d\u0434\u043e\u0440\u0430.", "creation_timestamp": "2026-08-06T00:00:59.069545Z"}, {"uuid": "62813ac8-aa84-459e-b470-7221608a9c68", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-20896", "type": "seen", "source": "https://bsky.app/profile/thecybersecguru.com/post/3mp65jcs6sh27", "content": "Three Vulnerabilities, One Platform: Why Your Self-Hosted Gitea/Gogs Instance Is Probably Already\u00a0Owned\n\nThree critical Gitea and Gogs CVEs disclosed in 2026: a CVSS 9.8 auth bypass via X-WEBAUTH-USER header,\u2026\n\nhttps://thecybersecguru.com/news/cve-2026-20896-gitea-authentication-bypass-dom-xss-ssrf/", "creation_timestamp": "2026-06-26T04:52:06.315766Z"}, {"uuid": "5857cd07-0f83-4f7f-9f57-40a5891e8b71", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "Telegram/EqoYaV6nsS8NdFMiUlh20F2PL0M0xTB12P2J_sYTarvuZL8", "content": "", "creation_timestamp": "2026-08-17T18:00:06.053636Z"}, {"uuid": "14f3e0e2-5231-4042-b873-690a5cf28e2b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "Telegram/qtlWc_b7dirbvxiOK4Nhc4t041ZYL6xsiFpFlakikDua2bE", "content": "", "creation_timestamp": "2026-08-17T18:00:06.150408Z"}, {"uuid": "fc8bee44-ecb4-4692-a320-a34f4b558312", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/shiojiri.com/post/3mpidt76pcsbr", "content": "\u533f\u540d\u306e\u7814\u7a76\u8005\u304c\u30bc\u30ed\u30c7\u30a4\u6570\u4ef6\u3092GitHub\u30ea\u30dd\u30b8\u30c8\u30ea\u3067\u516c\u958b\uff08CVE-2026-55200\u3001CVE-2026-20896\uff09 | Codebook\uff5cSecurity News https://codebook.machinarecord.com/threatreport/silobreaker-cyber-alert/46394/", "creation_timestamp": "2026-06-30T06:11:34.296661Z"}, {"uuid": "672973c2-2cc6-42ad-882c-039e474f5a47", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/potato.software/post/3mpidta6bgb2n", "content": "\u533f\u540d\u306e\u7814\u7a76\u8005\u304c\u30bc\u30ed\u30c7\u30a4\u6570\u4ef6\u3092GitHub\u30ea\u30dd\u30b8\u30c8\u30ea\u3067\u516c\u958b\uff08CVE-2026-55200\u3001CVE-2026-20896\uff09 | Codebook\uff5cSecurity News https://codebook.machinarecord.com/threatreport/silobreaker-potato-alert/46394/", "creation_timestamp": "2026-06-30T06:11:36.036527Z"}, {"uuid": "f027333f-5b0f-49a0-94de-24feb6e5e46b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "published-proof-of-concept", "source": "Telegram/qtlWc_b7dirbvxiOK4Nhc4t041ZYL6xsiFpFlakikDua2bE", "content": "", "creation_timestamp": "2026-08-18T00:00:09.960998Z"}, {"uuid": "15f57a95-8606-480f-a8c8-e14b4ff65dc7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "published-proof-of-concept", "source": "Telegram/EqoYaV6nsS8NdFMiUlh20F2PL0M0xTB12P2J_sYTarvuZL8", "content": "", "creation_timestamp": "2026-08-18T00:00:10.191948Z"}, {"uuid": "c068d707-8172-41f5-9b49-d04721662b22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mprkvjpwpw2x", "content": "CVE-2026-20896 - gitea open source git server\nGitea's Docker image has a security setting that allows anyone to pretend to be a user when using certain reverse-proxy authentication headers. This is a concern because it\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#gitea #CVE #infosec", "creation_timestamp": "2026-07-03T22:12:05.560700Z"}, {"uuid": "4a3f4580-eddd-4df0-9f29-1c8d4e7238d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mpv7wdllhg2p", "content": "CVE-2026-20896 - Critical auth bypass in Gitea Docker images \u22641.26.2. Default REVERSE_PROXY_TRUSTED_PROXIES=* allows IP spoofing via X-WEBAUTH-USER headers. CVSS 9.8. No patch available. Update config now. #CVE #Gitea #infosec\n\nhttps://www.valtersit.com/cve/CVE-2026-20896/", "creation_timestamp": "2026-07-05T09:06:20.854926Z"}, {"uuid": "8c336f91-b863-4fda-a8e3-27716908f04b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "published-proof-of-concept", "source": "Telegram/wffTTuVgQJ98JwhL42Ct7GiTcbOZOW8KxITp_kb-2yHdqmI", "content": "", "creation_timestamp": "2026-08-22T00:00:28.690958Z"}, {"uuid": "ca843669-58f4-4ca7-9201-8299e4fc9abe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mpwhtesstw2e", "content": "\ud83d\udd34 CVE-2026-20896 - Critical (9.8)\n\nGitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by def...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-20896/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-05T21:00:31.349197Z"}, {"uuid": "f599afe7-03ef-42b4-a6a5-fb45c4ec88d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mpym3e6xsa2p", "content": "Threat actors attempt to exploit CVE-2026-20896 in Gitea Docker images by abusing trusted reverse-proxy authentication via the X-WEBAUTH-USER header.\n", "creation_timestamp": "2026-07-06T17:21:53.550435Z"}, {"uuid": "71ae1653-92fb-4fd9-9a3d-46be2804dba8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/hapsis.bsky.social/post/3mpyquy64dk2n", "content": "Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure\n\nthehackernews.com/2026/07/thre...\n\n#Cybersecurity #ThreatIntel #Vulnerability", "creation_timestamp": "2026-07-06T18:48:11.058488Z"}, {"uuid": "69d0eb7e-5e88-4822-8694-43cec8625307", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mpyjmjuh2f24", "content": "Threat actors probe Gitea Docker flaw CVE-2026-20896; update to version 1.26.3 immediately. #Gitea #Docker #CVE202620896 #CyberSecurity #DevOps #ContainerSecurity #Sysdig thedailytechfeed.com/threat-actor...", "creation_timestamp": "2026-07-06T16:37:48.940283Z"}, {"uuid": "77936aba-b592-470f-b3d0-d8ee5d3eafa8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/happeningnow.news/post/3mpymmfpqcp2s", "content": "Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure\nThreat actors have been observed attempting to exploit a recently patched critical security flaw in Gitea Docker images, according to Sysdig. The vulnerability in question is\u2026\n\n\ud83d\udd17 https://hnow.live/a/54e7dfd1", "creation_timestamp": "2026-07-06T17:31:26.339917Z"}, {"uuid": "0c39f5d1-fc43-4495-913d-10a503439e4c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mpynfgf3qn2w", "content": "Threat actors are probing Gitea Docker CVE-2026-20896, where trusted X-WEBAUTH-USER headers could enable user impersonation. Affects images through 1.26.2; fixed in 1.26.3. #Gitea #CVE-2026-20896 #Sysdig", "creation_timestamp": "2026-07-06T17:45:25.477030Z"}, {"uuid": "8dbb2c57-3add-4c81-a466-bf3a48e85381", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mpynjni2522p", "content": "CVE-2026-20896: Threat Actors Probing Gitea Docker Flaw Just 13 Days Post-Disclosure #CVE #Gitea #Docker", "creation_timestamp": "2026-07-06T17:47:46.826896Z"}, {"uuid": "81621d94-49ea-4b04-84fd-d4c1a8c78f9e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mpynjscrlz2v", "content": "CVE-2026-20896: Gitea's Critical Docker Flaw Ignites Immediate Attacker Interest #CVE202620896 #Gitea #Docker", "creation_timestamp": "2026-07-06T17:47:51.999147Z"}, {"uuid": "de01c308-d3bf-4c7b-b904-595ee9f6b0fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mpynjw3voa26", "content": "CVE-2026-20896: Quick Probes on Gitea Docker Flaw Raise Alarms #CVE2026 #Gitea #DockerSecurity", "creation_timestamp": "2026-07-06T17:47:55.730040Z"}, {"uuid": "51c2c8d5-548c-45ec-aa3f-42391f54e4a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mpynjzcgtb2v", "content": "CVE-2026-20896: Gitea Docker's Flawed Trust Model Exposes Users to Attacks #CVE202620896 #Gitea #DockerSecurity", "creation_timestamp": "2026-07-06T17:47:59.446838Z"}, {"uuid": "2856693d-163a-4f6f-9921-79903909f8ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mpynocazyj2v", "content": "CVE-2026-20896: Attackers Probing Gitea Docker Flaw Raising Eyebrows #CyberSecurity #CVE2026 #Gitea", "creation_timestamp": "2026-07-06T17:50:23.453041Z"}, {"uuid": "84782018-f928-4998-8a36-765624c27819", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mpynofl34f2k", "content": "CVE-2026-20896: Are Threat Actors Exploiting Gitea Flaws Too Soon? #CVE202620896 #GiteaSecurity #ThreatActors", "creation_timestamp": "2026-07-06T17:50:26.511200Z"}, {"uuid": "e205fcc4-3389-4c69-b45d-bebf48c37fad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/cybersecurity0001.bsky.social/post/3mpynoifcex2v", "content": "Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure", "creation_timestamp": "2026-07-06T17:50:29.501152Z"}, {"uuid": "7c1446c0-6b50-46f1-8410-31bee4a6ae60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mpyowhw5i32x", "content": "Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure", "creation_timestamp": "2026-07-06T18:12:50.833036Z"}, {"uuid": "e89b442e-1e5f-4538-8224-70fb6e494caa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mpyqphtlhf2i", "content": "Gitea's official Docker image trusts the X-WEBAUTH-USER login header from any IP, so with reverse-proxy auth on, anyone reachable can log in as any user, no password.\n\nAffects images through 1.26.2. Fix: upgrade to 1.26.3. (CVE-2026-20896)", "creation_timestamp": "2026-07-06T18:44:43.380456Z"}, {"uuid": "b773791e-44e3-496f-818f-552c3a53527d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://thehackernews.com/2026/07/threat-actors-probe-gitea-docker-flaw.html", "content": "Threat actors have been observed attempting to exploit a recently patched critical security flaw in Gitea Docker images, according to Sysdig.\n\nThe vulnerability in question is CVE-2026-20896 (CVSS score: 9.8), a vulnerability that stems from the DevOps platform trusting the \"X-WEBAUTH-USER\" header from any source IP address, effectively allowing an unauthenticated internet client to get elevated", "creation_timestamp": "2026-07-06T19:00:42.499529Z"}, {"uuid": "03023146-be47-4246-bdf3-fd4a02659e29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-20896", "type": "seen", "source": "https://bsky.app/profile/blindthoughts.bsky.social/post/3mpyvtlmep32k", "content": "Active Exploitation: Patch CVE-2026-20896 in Gitea Docker Now (CVSS 9.8)\n\nhttps://blindthoughts.com/cve-2026-20896-gitea-docker-active-exploitation\n\n#vulnerability #gitea #docker #cve #activeexploitation", "creation_timestamp": "2026-07-06T20:16:29.915258Z"}, {"uuid": "793f96a2-2a7c-4386-ab8a-00fc63042ca8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mpyyqnac3b2j", "content": "\ud83e\udd16 CVE-2026-20896 (CVSS 9.8): Critical Gitea Docker flaw \u2014 unauthenticated RCE via X-WEBAUTH-USER header spoofing. Active exploitation detected.\n\nhttps://thehackernews.com/2026/07/threat-actors-probe-gitea-docker-flaw.html", "creation_timestamp": "2026-07-06T21:08:32.065365Z"}, {"uuid": "5c53ee2a-dc3c-45fb-a90c-37c2fe9d82dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/sleepydogtsjp.bsky.social/post/3mpz2kitryc2r", "content": "Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure\nthehackernews.com/2026/07/thre...", "creation_timestamp": "2026-07-06T21:40:55.805381Z"}, {"uuid": "479f1e17-4c9f-4a4b-bf6c-1ebddbb13dee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mpz4ri2krg2b", "content": "\u8105\u5a01\u30a2\u30af\u30bf\u30fc\u304cGitea\u306eDocker\u8106\u5f31\u6027CVE-2026-20896\u3092\u8abf\u67fb\uff08\u516c\u958b\u304b\u308913\u65e5\u5f8c\uff09 \n\nThreat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure  #HackerNews (Jul 6)\n\nthehackernews.com/2026/07/thre...", "creation_timestamp": "2026-07-06T22:20:36.242482Z"}, {"uuid": "53b1c07f-c037-4bc5-9e60-10dbd0b30767", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/crustytldr.bsky.social/post/3mpz3q4byjv2l", "content": "\ud83d\udcf0 Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure\n\nThreat actors have been observed attempting to exploit a recently patched critical security flaw in Gitea Docker i...\n\nhttps://tinyurl.com/2demjwlz #TechNews #CrustyTLDR", "creation_timestamp": "2026-07-06T22:01:55.624608Z"}, {"uuid": "dbafe40f-a96f-4d80-81df-4189c9b6c725", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/iberianm.bsky.social/post/3mpzpr7kl4q2m", "content": "Gitea Docker flaw CVE-2026-20896: attackers probe the patched issue quickly. Defenders should upgrade Gitea images to the fixed version and verify X-WEBAUTH handling. #Cybersecurity #Vulnerability #ThreatIntel\n\nSource: https://thehackernews.com/2026/07/threat-actors-probe-gitea-docker-flaw.html", "creation_timestamp": "2026-07-07T04:00:27.815740Z"}, {"uuid": "edc88acb-c4b1-4793-8ca2-9c6b63781557", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://thehackernews.com/2026/07/threat-actors-probe-gitea-docker-flaw.html", "content": "Threat actors have been observed attempting to exploit a recently patched critical security flaw in Gitea Docker images, according to Sysdig.\n\nThe vulnerability in question is CVE-2026-20896 (CVSS score: 9.8), a vulnerability that stems from the DevOps platform trusting the \"X-WEBAUTH-USER\" header from any source IP address, effectively allowing an unauthenticated internet client to get elevated", "creation_timestamp": "2026-07-07T01:00:43.011535Z"}, {"uuid": "1bc2b1c3-4021-48c1-81f4-1f5925d95b45", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/ninjaowl.ai/post/3mpzou6injh2q", "content": "Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure #cybersecurity #hacking #news #infosec #security #technology #privacy thehackernews.com/20...", "creation_timestamp": "2026-07-07T03:44:13.678490Z"}, {"uuid": "3193eb4a-e861-4e49-8dba-6e8ad0542c47", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/reconbee.bsky.social/post/3mq2qiha23s25", "content": "Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure reconbee.com/threat-actor...\n\n#cyberthreats #Giteadockerflaw #probe #cybersecurity #cyberattack", "creation_timestamp": "2026-07-07T13:46:10.900691Z"}, {"uuid": "9e3c79cd-e3d2-4ffc-92eb-c3801c5cf498", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mq34u5qnff2h", "content": "Gitea\u306e\u91cd\u5927\u306a\u8106\u5f31\u6027\u3001\u5b9f\u969b\u306b\u60aa\u7528\u304c\u78ba\u8a8d\u3055\u308c\u308b\u2015\u2015\u7814\u7a76\u8005\u3089\u304c\u8b66\u544a\n\n\u8105\u5a01\u30a2\u30af\u30bf\u30fc\u3089\u306f\u3001Gitea\u306e\u30ea\u30d0\u30fc\u30b9\u30d7\u30ed\u30ad\u30b7\u8a8d\u8a3c\u6a5f\u69cb\u306b\u5b58\u5728\u3059\u308b\u8106\u5f31\u6027\u3092\u60aa\u7528\u3057\u3001\u6709\u52b9\u306a\u30e6\u30fc\u30b6\u30fc\u540d\u3092\u4e00\u3064\u6307\u5b9a\u3059\u308b\u3060\u3051\u3067\u3001\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8\u304b\u3089\u30a2\u30af\u30bb\u30b9\u53ef\u80fd\u306a\u30a4\u30f3\u30b9\u30bf\u30f3\u30b9\u306b\u4fb5\u5165\u3057\u3066\u3044\u307e\u3059\u3002 \u3053\u306e\u91cd\u5927\u306a\u8106\u5f31\u6027\u306fGitea\u306e\u516c\u5f0fDocker\u30a4\u30e1\u30fc\u30b8\u306b\u56fa\u6709\u306e\u3082\u306e\u3067\u3001CVE-2026-20896\uff08CVSS\u30b9\u30b3\u30a29.8\uff09\u3068\u3057\u3066\u8ffd\u8de1\u3055\u308c", "creation_timestamp": "2026-07-07T17:27:24.624022Z"}, {"uuid": "d6b43c8e-e4e1-4963-9c3c-4c189ad75d00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/116879910895582885", "content": "\ud83d\udea8 Critical Gitea flaw CVE-2026-20896 is being probed in the wild\nResearchers warn that attackers are targeting a critical Gitea Docker image flaw that can allow authentication bypass with a single HTTP header.\nThe issue affects official Gitea Docker images up to 1.26.2 when reverse-proxy authentication is enabled.\nThe vulnerable default trusted any source IP as a reverse proxy, meaning an attacker who could reach the container\u2019s HTTP port could spoof X-WEBAUTH-USER and impersonate a known or guessable user.\nGitea patched the issue in 1.26.3 / 1.26.4, and a public PoC/checker is now available.\nSysdig says the first in-the-wild probing was seen 13 days after disclosure.\nObserved IP: 159[.]26[.]98[.]241", "creation_timestamp": "2026-07-07T17:38:26.634669Z"}, {"uuid": "c2729baf-f62b-4f67-a0dd-d988d6ea66d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mq35lpurkk2a", "content": "Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure\n\nThreat actors have been observed attempting to exploit a recently patched critical security flaw in Gitea Docker images, according to Sysdig.\n\nThe vulnerability in question is CVE-2026-20896 (CVSS score\u2026\n#hackernews #news", "creation_timestamp": "2026-07-07T17:40:35.826520Z"}, {"uuid": "fe3e7441-4c6e-40a9-80ce-ab87a2dbf6e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mq3gkwd45g2c", "content": "CVE-2026-20896: Gitea's Critical Flaw Exposes 6,200 Instances to Compromise #Gitea #CVE2026 #CyberSecurity", "creation_timestamp": "2026-07-07T20:21:12.968218Z"}, {"uuid": "791859c9-90c6-454f-a412-945a966f25d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mq3gl63xzu2p", "content": "CVE-2026-20896: Gitea's Critical Flaw Demands Urgent Action from Users #CVE2026 #Gitea #CyberSecurity", "creation_timestamp": "2026-07-07T20:21:24.576939Z"}, {"uuid": "eb4e7947-3db2-4ddb-81d6-0ee5bce10dfc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mq3glbti7d26", "content": "CVE-2026-20896: Gitea\u2019s Worrying Flaw Exposes Repositories to Attackers #CVE2026 #Gitea #CyberSecurity", "creation_timestamp": "2026-07-07T20:21:26.120991Z"}, {"uuid": "167612d7-fbc9-4b4a-b58c-e636de1277d9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mq3glfiwzg2c", "content": "CVE-2026-20896: Gitea's Critical Flaw Exposes Serious Governance Failures #CVE2026 #Gitea #Cybersecurity", "creation_timestamp": "2026-07-07T20:21:28.432106Z"}, {"uuid": "1acdf224-80db-408a-acb4-db09258a3082", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mq3gljudwf2g", "content": "CVE-2026-20896: Gitea's Critical Flaw Shows Our Fragile Patch Culture #CVE202620896 #Gitea #Cybersecurity", "creation_timestamp": "2026-07-07T20:21:33.210293Z"}, {"uuid": "e48ed6b3-9208-4734-b3c0-c0830c91fc9b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mq3glndvbs25", "content": "CVE-2026-20896: Critical Gitea Vulnerability \u2014 Urgent Response or Overblown Risk? #CyberSecurity #Vulnerability #Gitea", "creation_timestamp": "2026-07-07T20:21:36.709508Z"}, {"uuid": "a756ef80-6338-453c-98b7-ed54a36987a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/poxek.bsky.social/post/3mq3imnlegs2x", "content": "CVE-2026-20896 is a nasty Gitea Docker auth bypass: if reverse-proxy auth is enabled and the backend port is reachable, one HTTP header can impersonate a known user.\n\nX-WEBAUTH-USER: admin", "creation_timestamp": "2026-07-07T20:58:04.131298Z"}, {"uuid": "21f036c0-6555-4298-a3db-3ff3919d321e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/poxek.bsky.social/post/3mq3imnljd22x", "content": "CVE-2026-20896 is a nasty Gitea Docker auth bypass: if reverse-proxy auth is enabled and the backend port is reachable, one HTTP header can impersonate a known user.\n\nX-WEBAUTH-USER: admin", "creation_timestamp": "2026-07-07T20:58:05.475381Z"}, {"uuid": "3363e87e-724f-4a04-849b-e275e3db98c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/poxek.bsky.social/post/3mq3imnljd32x", "content": "CVE-2026-20896 is a nasty Gitea Docker auth bypass: if reverse-proxy auth is enabled and the backend port is reachable, one HTTP header can impersonate a known user.\n\nX-WEBAUTH-USER: admin", "creation_timestamp": "2026-07-07T20:58:06.828776Z"}, {"uuid": "5f4d49c9-9cde-4525-9a5c-4221e57d93b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/poxek.bsky.social/post/3mq3imnlkcd2x", "content": "CVE-2026-20896 is a nasty Gitea Docker auth bypass: if reverse-proxy auth is enabled and the backend port is reachable, one HTTP header can impersonate a known user.\n\nX-WEBAUTH-USER: admin", "creation_timestamp": "2026-07-07T20:58:08.214679Z"}, {"uuid": "0ac63e86-42e3-4204-a666-46bcd4067a08", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/poxek.bsky.social/post/3mq3imnlkce2x", "content": "CVE-2026-20896 is a nasty Gitea Docker auth bypass: if reverse-proxy auth is enabled and the backend port is reachable, one HTTP header can impersonate a known user.\n\nX-WEBAUTH-USER: admin", "creation_timestamp": "2026-07-07T20:58:09.852516Z"}, {"uuid": "f8df06a2-9388-4eac-8252-f3ebfd4c08ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/poxek.bsky.social/post/3mq3imox2uv2x", "content": "CVE-2026-20896 is a nasty Gitea Docker auth bypass: if reverse-proxy auth is enabled and the backend port is reachable, one HTTP header can impersonate a known user.\n\nX-WEBAUTH-USER: admin", "creation_timestamp": "2026-07-07T20:58:12.608226Z"}, {"uuid": "21c20d0b-30a1-402a-84d8-0e174d82f320", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/poxek.bsky.social/post/3mq3imox2uu2x", "content": "CVE-2026-20896 is a nasty Gitea Docker auth bypass: if reverse-proxy auth is enabled and the backend port is reachable, one HTTP header can impersonate a known user.\n\nX-WEBAUTH-USER: admin", "creation_timestamp": "2026-07-07T20:58:11.251158Z"}, {"uuid": "71857771-f9e0-4594-a1fd-873a87deff49", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/poxek.bsky.social/post/3mq3imox2uw2x", "content": "CVE-2026-20896 is a nasty Gitea Docker auth bypass: if reverse-proxy auth is enabled and the backend port is reachable, one HTTP header can impersonate a known user.\n\nX-WEBAUTH-USER: admin", "creation_timestamp": "2026-07-07T20:58:13.971632Z"}, {"uuid": "8f23c26e-0bb9-414f-bfd2-d9966088a489", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mq3jlslaca27", "content": "Active exploitation of CVE-2026-20896 lets attackers bypass Gitea auth with a valid username and one HTTP header, risking repo, secret, and CI/CD takeover. Update Docker images to 1.26.3. #Gitea #CVE202620896 #DevSecOps", "creation_timestamp": "2026-07-07T21:15:23.659334Z"}, {"uuid": "cd70650b-5da5-40f3-901d-a167591fab03", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mq3qfqngqi2f", "content": "CVE-2026-20896: Gitea's Docker Vulnerability Is a Recipe for Disaster #CyberSecurity #Vulnerability #Gitea", "creation_timestamp": "2026-07-07T23:17:16.565066Z"}, {"uuid": "7cd607fc-238e-4de7-81d1-26b96d651323", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mq3qfup33j27", "content": "CVE-2026-20896 Exposes Gitea Docker Repositories: Attackers Seizing Control #CVE202620896 #Gitea #Docker", "creation_timestamp": "2026-07-07T23:17:20.610586Z"}, {"uuid": "2046edb5-404c-4b30-a99d-46aa349614cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mq3qfzzak324", "content": "CVE-2026-20896: Gitea's Bug Exposes Repositories, Demands Urgent Attention #CVE202620896 #Gitea #CyberSecurity", "creation_timestamp": "2026-07-07T23:17:26.143975Z"}, {"uuid": "07ee9327-d719-4e23-b60d-d795b1154e67", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mq3qg6wsf32s", "content": "CVE-2026-20896: Gitea's Docker Flaw Exposes Critical Repositories Due to Configuration Failures #CVE202620896 #Gitea #Docker", "creation_timestamp": "2026-07-07T23:17:31.448100Z"}, {"uuid": "88bc5b1c-e5b3-4098-b23f-d4f43fc827a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mq3qgcu54z27", "content": "CVE-2026-20896: Gitea's Docker Flaw Exposes Repositories\u2014Is Anyone Paying Attention? #CVE202620896 #Gitea #Docker", "creation_timestamp": "2026-07-07T23:17:35.908797Z"}, {"uuid": "e81ca082-bee8-4328-b9bc-c1b0711d1b2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/cybernewsroom.bsky.social/post/3mq3qggs4ez27", "content": "CVE-2026-20896: Is Gitea's Critical Docker Vulnerability a Policy Failure? #CyberSecurity #Vulnerability #Gitea", "creation_timestamp": "2026-07-07T23:17:39.541976Z"}, {"uuid": "b1c1c27d-f48b-4f3f-ade3-fb9d51f53c40", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/technology-news.bsky.social/post/3mq474jhpg62i", "content": "CVE-2026-20896 lets reachable Gitea Docker containers trust spoofed X-WEBAUTH-USER headers when reverse proxy auth is enabled.", "creation_timestamp": "2026-07-08T03:40:32.735696Z"}, {"uuid": "1b352c32-b1f7-4695-be14-6183dfe490a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116882828726974974", "content": "CRITICAL: Gitea Docker (<1.26.3) is vulnerable to auth bypass (CVE-2026-20896) \u2014 attackers can access repos & secrets by spoofing a username header. Actively exploited! Patch to 1.26.3+ & restrict access now. https://radar.offseq.com/threat/critical-gitea-flaw-under-active-exploitation-rese-c58d67a324be5e40 #OffSeq #Gitea #Vuln #Infosec", "creation_timestamp": "2026-07-08T06:00:29.500188Z"}, {"uuid": "4f81d109-520e-4bd3-9a3d-6b14e87b41c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mq4gwsq67v2t", "content": "Gitea Docker (<1.26.3) hit by CRITICAL CVE-2026-20896. Auth bypass flaw is being exploited to access private code & secrets. Update to 1.26.3+ or restrict access immediately. https://radar.offseq.com/threat/critical-gitea-flaw-under-active-exploitation-rese-c58d67a324be5e40 #OffSeq #Gitea #Security", "creation_timestamp": "2026-07-08T06:00:31.269498Z"}, {"uuid": "a7f12491-0a62-4818-85e9-dfe624e5fc59", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/116884921124621905", "content": "\ud83d\udcf0 Critical Gitea Docker Flaw Actively Exploited for Unauthorized Access\n\ud83d\udd25 CRITICAL Gitea flaw (CVE-2026-20896, CVSS 9.8) is actively exploited! Insecure default in Docker images allows unauthenticated attackers to become admin. Update immediately or harden your proxy config! #Gitea #Vulnerability #DevSecOps\n\ud83c\udf10 cyber[.]netsecops[.]io\n\ud83d\udd17 https://cyber.netsecops.io/articles/critical-gitea-docker-flaw-actively-exploited-for-unauthorized-access/?utm_source=mastodon&utm_me\u2026", "creation_timestamp": "2026-07-08T14:52:36.954704Z"}, {"uuid": "f981045a-8a1e-4449-8109-e646d1dd48a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mq5epgvmwq2f", "content": "\ud83d\udd25 CRITICAL Gitea flaw (CVE-2026-20896, CVSS 9.8) is actively exploited! Insecure default in Docker images allows unauthenticated attackers to become admin. Update immediately or harden your proxy config! #Gitea #Vulnerability #DevSecOps\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-07-08T14:53:16.317267Z"}, {"uuid": "e8089181-a13d-4635-86e3-b334553cb6d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mq5yvuqybs2a", "content": "Critical Gitea Docker Bug Under Active Exploitation Exposes Repositories and Secrets\n\nAttackers are exploiting a critical Gitea flaw (CVE-2026-20896) that bypasses authentication with a single HTTP header, exposing repositories and sensitive data. Sysdig researchers warn that atta\u2026\n#hackernews #news", "creation_timestamp": "2026-07-08T20:54:47.476021Z"}, {"uuid": "f44ef31d-4708-4f53-99a0-811b77f4b620", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/eurotrends24.bsky.social/post/3mqbi56e2le2s", "content": "Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure", "creation_timestamp": "2026-07-10T06:05:16.978837Z"}, {"uuid": "02037afa-b7fd-44c8-902a-ffe78f37ba23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mqd25s3lhv2w", "content": "Hackers are exploiting CVE-2026-20896 in Gitea's Docker image, allowing auth bypass and user impersonation, including admins. The flaw affects default setups via reverse-proxy headers. #Gitea #Singapore #CVE2026", "creation_timestamp": "2026-07-10T21:00:25.133839Z"}, {"uuid": "dccbaf2a-596a-48dc-b5ae-3556186278e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mqds5kboup2q", "content": "\ud83e\udd16 CVE-2026-20896: Gitea Docker auth bypass actively exploited. Attackers impersonate any user including admins. Docker image trusted identity headers from any IP. Patch available.\nhttps://www.bleepingcomputer.com/news/security/hackers-exploit-critical-auth-bypass-in-gitea-docker-image/", "creation_timestamp": "2026-07-11T04:09:46.313704Z"}, {"uuid": "64740c48-49e0-417d-9d77-a4899e0cb906", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/blog.bubam.de/post/3mqdx3jldde22", "content": "Ein HTTP-Header gen\u00fcgt: Gitea-L\u00fccke CVE-2026-20896 (CVSS 9.8), aktiv ausgenutzt. Ich betreibe selbst eine Instanz \u2014 gepr\u00fcft, geh\u00e4rtet, aktualisiert. Und: \u201enicht erreichbar\" pr\u00fcft man von au\u00dfen, nicht im Config-File.\n\nhttps://blog.bubam.de/2026-07-11_gitea-ein-header-genuegt.html?s=bs", "creation_timestamp": "2026-07-11T05:38:07.342402Z"}, {"uuid": "1ac9aa24-c0db-4fff-b2c5-94bcbc6da5c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/eyalestrin.bsky.social/post/3mqebg4vrz62a", "content": "Urgent Action Required Gitea Docker Authentication Bypass (CVE-2026-20896 and CVE-2026-27771) #patchmanagement", "creation_timestamp": "2026-07-11T08:43:00.334770Z"}, {"uuid": "5e0acb44-ec18-4d0c-abba-9a097da920bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-20896", "type": "seen", "source": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mqeoqctp2g2s", "content": "\ud83d\udcf0 Peretas Aktif Mengeksploitasi Celah Kritis pada Docker Image Gitea, Bisa Login Sebagai Administrator\n\n\ud83d\udc49 Baca artikel lengkap di sini: https://ahmandonk.com/2026/07/11/kerentanan-gitea-docker-cve-2026-20896/\n\n#authenticationBypass #ci/cd #cve-2026-20896 #cyberSecurity #devops #docker #git #gi", "creation_timestamp": "2026-07-11T12:41:21.516481Z"}, {"uuid": "86aeec4b-d493-40fa-a8c1-6dc853d8491b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/116907370041051552", "content": "\ud83d\udcf0 Critical Gitea Docker Flaw Actively Exploited for Unauthorized Access\n\ud83d\udd25 CRITICAL Gitea flaw (CVE-2026-20896, CVSS 9.8) is actively exploited! Insecure default in Docker images allows unauthenticated attackers to become admin. Update immediately or harden your proxy config! #Gitea #Vulnerability #DevSecOps\n\ud83c\udf10 cyber[.]netsecops[.]io\n\ud83d\udd17 https://cyber.netsecops.io/articles/critical-gitea-docker-flaw-actively-exploited-for-unauthorized-access/?utm_source=mastodon&utm_me\u2026", "creation_timestamp": "2026-07-12T14:01:40.179846Z"}, {"uuid": "055bbba1-dfdb-4afd-b531-2a3f1c9b5851", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mqhdqcdr762h", "content": "\ud83d\udd25 CRITICAL Gitea flaw (CVE-2026-20896, CVSS 9.8) is actively exploited! Insecure default in Docker images allows unauthenticated attackers to become admin. Update immediately or harden your proxy config! #Gitea #Vulnerability #DevSecOps\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-07-12T14:02:28.137268Z"}, {"uuid": "2cb99295-c455-4aff-b2ae-aff16361266e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/technoholic.bsky.social/post/3mqhina72qx2p", "content": "Threat actors target a recent critical flaw in Gitea Docker images (CVE-2026-20896, CVSS 9.8). The bug allows unauthenticated clients to elevate privileges via the X-WEBAUTH-USER header.", "creation_timestamp": "2026-07-12T15:30:14.161615Z"}, {"uuid": "27f7e3bb-274b-4e9c-88e7-71c5e84604eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/aegisbot.bsky.social/post/3mqjngi26od2u", "content": "\ud83d\udd0d Top signals this week:\n\nCVEs: CVE-2026-48282, CVE-2026-50656, CVE-2026-55255, CVE-2026-20896, CVE-2026-53359\nActors: Ransomware, Apt, Play\n\nFull intel: https://matlock.ca/cybersecnews", "creation_timestamp": "2026-07-13T12:01:15.571749Z"}, {"uuid": "23abb9b5-8091-4970-a142-50318d44a74b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://t.me/poxek/6232", "content": "CVE-2026-20896 \u0432 Gitea \u0443\u0436\u0435 \u043d\u0430\u0447\u0430\u043b\u0438 \u0434\u0435\u0440\u0433\u0430\u0442\u044c \u0432\u0436\u0438\u0432\u0443\u044e: \u043f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Sysdig, \u043f\u0435\u0440\u0432\u0430\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u044f\u0432\u0438\u043b\u0430\u0441\u044c \u0447\u0435\u0440\u0435\u0437 13 \u0434\u043d\u0435\u0439 \u043f\u043e\u0441\u043b\u0435 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f\n\n\u0412 Docker-\u0448\u0430\u0431\u043b\u043e\u043d\u0435 app.ini \u0431\u044b\u043b \u0434\u0435\u0444\u043e\u043b\u0442 REVERSE_PROXY_TRUSTED_PROXIES = *, \u0445\u043e\u0442\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u0434\u043e\u043b\u0436\u043d\u043e \u0434\u043e\u0432\u0435\u0440\u044f\u0442\u044c \u0442\u043e\u043b\u044c\u043a\u043e loopback. \u0415\u0441\u043b\u0438 \u0430\u0434\u043c\u0438\u043d \u0432\u043a\u043b\u044e\u0447\u0438\u043b ENABLE_REVERSE_PROXY_AUTHENTICATION \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0437\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0438\u043c reverse proxy \u0438 \u043f\u0440\u0438 \u044d\u0442\u043e\u043c HTTP-\u043f\u043e\u0440\u0442 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043d\u0430\u043f\u0440\u044f\u043c\u0443\u044e, \u043b\u044e\u0431\u043e\u0439 \u043a\u043b\u0438\u0435\u043d\u0442 \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0441\u043b\u0430\u0442\u044c X-WEBAUTH-USER: poxek \u0438 \u043f\u043e\u043f\u0430\u0441\u0442\u044c \u0432 Gitea \u043a\u0430\u043a poxek \u0431\u0435\u0437 \u043f\u0430\u0440\u043e\u043b\u044f \u0438 \u0442\u043e\u043a\u0435\u043d\u0430.\n\n\u267e\ufe0f\u0418\u043c\u043f\u0430\u043a\u0442\u267e\ufe0f\n\u0418\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0439 \u0438\u043b\u0438 \u0443\u0433\u0430\u0434\u044b\u0432\u0430\u0435\u043c\u044b\u0439 \u043b\u043e\u0433\u0438\u043d \u043f\u0440\u0435\u0432\u0440\u0430\u0449\u0430\u0435\u0442\u0441\u044f \u0432 \u0441\u0435\u0441\u0441\u0438\u044e \u044d\u0442\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u0414\u043b\u044f admin, gitea_admin \u0438 \u043f\u043e\u0445\u043e\u0436\u0438\u0445 \u0438\u043c\u0435\u043d \u044d\u0442\u043e \u0443\u0436\u0435 \u043f\u043e\u043b\u043d\u044b\u0439 takeover Gitea \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f: \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u044b\u0435 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438, \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438, \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438, packages, \u0440\u0435\u043b\u0438\u0437\u044b, \u0432\u0435\u0431\u0445\u0443\u043a\u0438 \u0438 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e downstream CI/CD. RCE \u043d\u0435 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0433\u0430\u0440\u0430\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0431\u043b\u0435\u043a\u0431\u043e\u043a\u0441 \u0438\u043c\u043f\u0430\u043a\u0442\u043e\u043c \u0441\u0430\u043c\u043e\u0439 CVE; \u0435\u0433\u043e \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u044f\u0432\u043b\u044f\u0442\u044c \u0442\u043e\u043b\u044c\u043a\u043e \u0435\u0441\u043b\u0438 \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u0430\u044f \u0438\u043d\u0441\u0442\u0430\u043b\u043b\u044f\u0446\u0438\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0434\u043e\u0439\u0442\u0438 \u0434\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0447\u0435\u0440\u0435\u0437 runner, \u0445\u0443\u043a\u0438, CI-\u0441\u0435\u043a\u0440\u0435\u0442\u044b \u0438\u043b\u0438 deployment-\u043f\u0430\u0439\u043f\u043b\u0430\u0439\u043d.\n\n\u267e\ufe0fPoC\u267e\ufe0f\n\u042f \u043d\u0435 \u043d\u0430\u0448\u0451\u043b \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0445 PoC, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u043d\u0430\u043f\u0438\u0441\u0430\u043b \u0441\u0432\u043e\u0439 \u0438 \u0432\u044b\u043b\u043e\u0436\u0438\u043b \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0439 PoC/\u0447\u0435\u043a\u0435\u0440: szybnev/cve-2026-20896-gitea-poc\n\n\u0412 \u0440\u0435\u043f\u0435 \u0435\u0441\u0442\u044c Go-\u0432\u0435\u0440\u0441\u0438\u044f \u0434\u043b\u044f \u043c\u0430\u0441\u0441\u043e\u0432\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0441 --targets, --user-file, --concurrency, --jsonl \u0438 --dry-run, \u043f\u043b\u044e\u0441 \u043f\u0440\u043e\u0441\u0442\u043e\u0439 Bash \u0441\u043a\u0440\u0438\u043f\u0442\u0438\u043a \u0431\u0435\u0437 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u0427\u0435\u043a\u0435\u0440 \u0441\u043d\u0430\u0447\u0430\u043b\u0430 \u043f\u0430\u0440\u0441\u0438\u0442 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0443 \u0438 \u043d\u0435 \u0444\u0430\u0437\u0437\u0438\u0442 usernames, \u0435\u0441\u043b\u0438 \u0432\u0438\u0434\u0438\u0442 Gitea >=1.26.3, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440 Powered by Gitea Version: 1.26.4. \u0414\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0439 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 1.26.2 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442 impersonation \u043f\u043e title dashboard \u0431\u0435\u0437 cookie \u0438 \u043f\u0430\u0440\u043e\u043b\u044f.\n\n\u267e\ufe0f\u041c\u0438\u0442\u0438\u0433\u0430\u0446\u0438\u044f\u267e\ufe0f\n\u25aa\ufe0f\u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c\u0441\u044f \u043c\u0438\u043d\u0438\u043c\u0443\u043c \u0434\u043e 1.26.3, \u043b\u0443\u0447\u0448\u0435 \u0434\u043e 1.26.4+;\n\u25aa\ufe0f\u043d\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u0442\u044c giea \u043d\u0430\u043f\u0440\u044f\u043c\u0443\u044e\n\u25aa\ufe0f\u044f\u0432\u043d\u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c trusted proxies\n\u25aa\ufe0f\u043d\u0435 \u0432\u043a\u043b\u044e\u0447\u0430\u0442\u044c reverse-proxy auth \u0431\u0435\u0437 \u043f\u043e\u043d\u044f\u0442\u043d\u043e\u0439 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0433\u0440\u0430\u043d\u0438\u0446\u044b\n\n\ud83d\udd17\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438:\nGHSA-f75j-4cw6-rmx4 / Gitea 1.26.3/1.26.4 release notes\nfix PR #38151 / CVE record\nSysdig telemetry via The Hacker News\n\n\ud83c\udf1a @poxek | \ud83c\udf1a @poxek_ai | \ud83d\udcf2 MAX", "creation_timestamp": "2026-07-13T13:00:04.298669Z"}, {"uuid": "0b5434e5-f2b7-4e7d-9b92-9e531eb18311", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://t.me/true_secator/8383", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 Sysdig \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u044e\u0442 \u043e \u043d\u0430\u0447\u0430\u043b\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043e\u0431\u0440\u0430\u0437\u0430\u0445 Docker Gitea.\n\nCVE-2026-20896\u00a0(CVSS: 9,8) \u043e\u0431\u0443\u0441\u043b\u043e\u0432\u043b\u0435\u043d\u0430 \u0442\u0435\u043c, \u0447\u0442\u043e \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430 DevOps \u0434\u043e\u0432\u0435\u0440\u044f\u0435\u0442 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0443 X-WEBAUTH-USER \u043e\u0442 \u043b\u044e\u0431\u043e\u0433\u043e \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u0433\u043e IP, \u0447\u0442\u043e \u0444\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u043a\u043b\u0438\u0435\u043d\u0442\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0410\u043b\u0438 \u041c\u0443\u0441\u0442\u0430\u0444\u0430, \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u043f\u0440\u0438\u043f\u0438\u0441\u044b\u0432\u0430\u044e\u0442 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0441\u043e\u043e\u0431\u0449\u0438\u043b, \u0447\u0442\u043e \u043e\u0431\u0440\u0430\u0437\u044b Docker \u043e\u0442 Gitea \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u043b\u0438 \u0448\u0430\u0431\u043b\u043e\u043d app.ini, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0436\u0435\u0441\u0442\u043a\u043e \u0437\u0430\u0434\u0430\u043d\u043e \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 REVERSE_PROXY_TRUSTED_PROXIES = *.\n\n\u0424\u0430\u0439\u043b app.ini \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u043c \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u043c \u0444\u0430\u0439\u043b\u043e\u043c \u0434\u043b\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430\u043c\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f\u043c\u0438 \u043a \u0431\u0430\u0437\u0430\u043c \u0434\u0430\u043d\u043d\u044b\u0445, \u043f\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u0435\u043c \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u043c\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f.\n\n\u041f\u0440\u0438 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u043e\u043c \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u043c \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u044d\u0442\u043e\u0442 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u0447\u043d\u044b\u0439 \u0437\u043d\u0430\u043a \u0434\u043e\u0432\u0435\u0440\u044f\u0435\u0442 \u043a\u0430\u0436\u0434\u043e\u043c\u0443 IP \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0430, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u043b\u044e\u0431\u043e\u0439, \u043a\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043f\u043e\u0440\u0442\u0443, \u043c\u043e\u0436\u0435\u0442 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043e\u043a X-WEBAUTH-USER \u0438 \u043f\u0440\u043e\u0439\u0442\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u043a\u0430\u043a \u043b\u044e\u0431\u043e\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c, \u0431\u0435\u0437 \u043f\u0430\u0440\u043e\u043b\u044f \u0438 \u0442\u043e\u043a\u0435\u043d\u0430.\n\n\u0421\u0442\u043e\u0438\u0442 \u043e\u0442\u043c\u0435\u0442\u0438\u0442\u044c, \u0447\u0442\u043e \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 REVERSE_PROXY_TRUSTED_PROXIES - 127.0.0.0/8,::1/128, \u0447\u0442\u043e \u043e\u0437\u043d\u0430\u0447\u0430\u0435\u0442, \u0447\u0442\u043e \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d \u0442\u043e\u043b\u044c\u043a\u043e localhost, \u0442\u043e \u0435\u0441\u0442\u044c \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0439 \u0441\u0432\u044f\u0437\u0438.\n\n\u041e\u0434\u043d\u0430\u043a\u043e \u0432 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u043c \u043e\u0431\u0440\u0430\u0437\u0435 Docker \u044d\u0442\u043e \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043d\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f, \u0432\u043c\u0435\u0441\u0442\u043e \u043d\u0435\u0433\u043e \u0436\u0435\u0441\u0442\u043a\u043e \u0437\u0430\u0434\u0430\u043d \u0441\u0438\u043c\u0432\u043e\u043b \"*\". \u0414\u0440\u0443\u0433\u0438\u043c\u0438 \u0441\u043b\u043e\u0432\u0430\u043c\u0438, \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u0432 \u0441\u043f\u0438\u0441\u043a\u0435 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0444\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442.\n\n\u0422\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u0435\u0441\u043b\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 ENABLE_REVERSE_PROXY_AUTHENTICATION = true, \u0447\u0442\u043e\u0431\u044b Gitea \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0438\u0439 \u043e\u0431\u0440\u0430\u0442\u043d\u044b\u0439 \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440, \u0438 \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 REVERSE_PROXY_TRUSTED_PROXIES \u0432 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, \u044d\u0442\u043e \u0440\u0430\u0437\u0440\u0435\u0448\u0430\u0435\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0439 HTTP-\u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043e\u043a X-WEBAUTH-USER \u0441 \u043b\u044e\u0431\u043e\u0433\u043e \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u0433\u043e IP, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0436\u0435\u0442 \u0434\u043e\u0441\u0442\u0438\u0447\u044c \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430.\n\n\u041b\u044e\u0431\u043e\u0439 \u043f\u0440\u043e\u0446\u0435\u0441\u0441, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0436\u0435\u0442 \u043d\u0430\u043f\u0440\u044f\u043c\u0443\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a HTTP-\u043f\u043e\u0440\u0442\u0443 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 Gitea - \u043d\u0435 \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u044b\u0439 \u0434\u043b\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440 - \u043c\u043e\u0436\u0435\u0442 \u0432\u044b\u0434\u0430\u0442\u044c \u0441\u0435\u0431\u044f \u0437\u0430 \u043b\u044e\u0431\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0447\u044c\u0435 \u0438\u043c\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e \u0438\u043b\u0438 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0443\u0433\u0430\u0434\u0430\u043d\u043e.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043e\u0431\u0440\u0430\u0437\u044b Docker Gitea \u0432\u0435\u0440\u0441\u0438\u0439 \u0434\u043e 1.26.2 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e. \u041e\u043d\u0430 \u0431\u044b\u043b\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 1.26.3, \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u0439 \u0432 \u043a\u043e\u043d\u0446\u0435 \u043f\u0440\u043e\u0448\u043b\u043e\u0433\u043e \u043c\u0435\u0441\u044f\u0446\u0430, \u0433\u0434\u0435 \u0431\u044b\u043b \u0443\u0434\u0430\u043b\u0435\u043d \u0441\u0438\u043c\u0432\u043e\u043b \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \"*\", \u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u0447\u0435\u0440\u0435\u0437 \u043e\u0431\u0440\u0430\u0442\u043d\u044b\u0439 \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440 \u0441\u0442\u0430\u043b\u0430 \u043d\u0435\u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0439.\n\nSysdig \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e\u0431 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0438 \u043f\u0435\u0440\u0432\u043e\u0439 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u0441\u043f\u0443\u0441\u0442\u044f 13 \u0434\u043d\u0435\u0439 \u043f\u043e\u0441\u043b\u0435 \u0435\u0435 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f. \u0420\u0435\u0447\u044c \u0438\u0434\u0435\u0442 \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u043e 6200 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0438\u0437 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0430 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u0430\u0445 Gitea.\n\n\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u043f\u0435\u0440\u0432\u044b\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441 IP-\u0430\u0434\u0440\u0435\u0441\u0430 \u0441\u0435\u0440\u0432\u0438\u0441\u0430 ProtonVPN, 159.26.98[.]241, \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u043d\u0435 \u043f\u0440\u0438\u0432\u0435\u043b\u0430 \u043a \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438\u043b\u0438 \u0430\u0442\u0430\u043a\u0435. \u041a\u0430\u043a \u0441\u0447\u0438\u0442\u0430\u044e\u0442 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438, \u044d\u0442\u043e \u0441\u0432\u044f\u0437\u0430\u043d\u043e \u0441 \u0442\u0435\u043c, \u0447\u0442\u043e \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0431\u044b\u043b\u043e \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043e \u043d\u0430 \u0440\u0430\u043d\u043d\u0435\u0439 \u0441\u0442\u0430\u0434\u0438\u0438, \u0434\u043e \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u0430\u0442\u0430\u043a\u0430 \u0443\u0441\u043f\u0435\u043b\u0430 \u0440\u0430\u0437\u0432\u0438\u0442\u044c\u0441\u044f \u0434\u0430\u043b\u044c\u0448\u0435 \u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0439 \u0444\u0430\u0437\u044b.\n\n\u0423\u0447\u0438\u0442\u044b\u0432\u0430\u044f \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0438 \u043d\u0430\u0447\u0430\u0432\u0448\u0443\u044e\u0441\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e, \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u043a\u0440\u0430\u0439\u043d\u0435 \u0432\u0430\u0436\u043d\u043e \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0441\u043a\u043e\u0440\u0435\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u0438\u0442\u044c \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u043e\u043f\u0442\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u044b.", "creation_timestamp": "2026-07-13T13:00:05.388873Z"}, {"uuid": "9294b064-9ab3-4e41-a8f2-a20054df64cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://t.me/GithubRedTeam/92405", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-20896-gitea-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a szybnev\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Go\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-07 20:31:29\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-20896 Gitea Docker X-WEBAUTH-USER auth bypass checker\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T22:00:10.059989Z"}, {"uuid": "bd38a2a4-7514-4e64-9bd8-b7a57425d330", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://t.me/GithubRedTeam/92061", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-20896\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a rz1027\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-05 15:52:46\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPublic PoC and detector for CVE-2026-20896 (\"Gitea Docker: One Header, Any User\")\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T22:00:12.397895Z"}, {"uuid": "9fa62c00-6a61-461c-88bd-fa23731e980d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://t.me/GithubRedTeam/91524", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-20896\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a kaleth4\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-02 00:23:50\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T22:00:15.684185Z"}, {"uuid": "08bebc64-3e3b-4b74-aff8-4c46de69c8af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://t.me/GithubRedTeam/91524", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-20896\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a kaleth4\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-02 00:23:50\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-14T00:00:32.403303Z"}, {"uuid": "b41f52f3-0124-4db1-9c1e-bfddf8217510", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://t.me/GithubRedTeam/92405", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-20896-gitea-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a szybnev\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Go\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-07 20:31:29\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-20896 Gitea Docker X-WEBAUTH-USER auth bypass checker\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-14T00:00:18.608029Z"}, {"uuid": "ba3f9705-1398-49bf-b0cc-4886da8a2e0f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://t.me/GithubRedTeam/92061", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-20896\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a rz1027\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-05 15:52:46\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPublic PoC and detector for CVE-2026-20896 (\"Gitea Docker: One Header, Any User\")\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-14T00:00:20.592240Z"}, {"uuid": "cc3f60f3-50e3-4e4f-b20a-c3ed2593e7b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "exploited", "source": "https://t.me/true_secator/8383", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 Sysdig \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u044e\u0442 \u043e \u043d\u0430\u0447\u0430\u043b\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043e\u0431\u0440\u0430\u0437\u0430\u0445 Docker Gitea.\n\nCVE-2026-20896\u00a0(CVSS: 9,8) \u043e\u0431\u0443\u0441\u043b\u043e\u0432\u043b\u0435\u043d\u0430 \u0442\u0435\u043c, \u0447\u0442\u043e \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430 DevOps \u0434\u043e\u0432\u0435\u0440\u044f\u0435\u0442 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0443 X-WEBAUTH-USER \u043e\u0442 \u043b\u044e\u0431\u043e\u0433\u043e \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u0433\u043e IP, \u0447\u0442\u043e \u0444\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u043a\u043b\u0438\u0435\u043d\u0442\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0410\u043b\u0438 \u041c\u0443\u0441\u0442\u0430\u0444\u0430, \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u043f\u0440\u0438\u043f\u0438\u0441\u044b\u0432\u0430\u044e\u0442 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0441\u043e\u043e\u0431\u0449\u0438\u043b, \u0447\u0442\u043e \u043e\u0431\u0440\u0430\u0437\u044b Docker \u043e\u0442 Gitea \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u043b\u0438 \u0448\u0430\u0431\u043b\u043e\u043d app.ini, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0436\u0435\u0441\u0442\u043a\u043e \u0437\u0430\u0434\u0430\u043d\u043e \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 REVERSE_PROXY_TRUSTED_PROXIES = *.\n\n\u0424\u0430\u0439\u043b app.ini \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u043c \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u043c \u0444\u0430\u0439\u043b\u043e\u043c \u0434\u043b\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430\u043c\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f\u043c\u0438 \u043a \u0431\u0430\u0437\u0430\u043c \u0434\u0430\u043d\u043d\u044b\u0445, \u043f\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u0435\u043c \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u043c\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f.\n\n\u041f\u0440\u0438 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u043e\u043c \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u043c \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u044d\u0442\u043e\u0442 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u0447\u043d\u044b\u0439 \u0437\u043d\u0430\u043a \u0434\u043e\u0432\u0435\u0440\u044f\u0435\u0442 \u043a\u0430\u0436\u0434\u043e\u043c\u0443 IP \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0430, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u043b\u044e\u0431\u043e\u0439, \u043a\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043f\u043e\u0440\u0442\u0443, \u043c\u043e\u0436\u0435\u0442 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043e\u043a X-WEBAUTH-USER \u0438 \u043f\u0440\u043e\u0439\u0442\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u043a\u0430\u043a \u043b\u044e\u0431\u043e\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c, \u0431\u0435\u0437 \u043f\u0430\u0440\u043e\u043b\u044f \u0438 \u0442\u043e\u043a\u0435\u043d\u0430.\n\n\u0421\u0442\u043e\u0438\u0442 \u043e\u0442\u043c\u0435\u0442\u0438\u0442\u044c, \u0447\u0442\u043e \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 REVERSE_PROXY_TRUSTED_PROXIES - 127.0.0.0/8,::1/128, \u0447\u0442\u043e \u043e\u0437\u043d\u0430\u0447\u0430\u0435\u0442, \u0447\u0442\u043e \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d \u0442\u043e\u043b\u044c\u043a\u043e localhost, \u0442\u043e \u0435\u0441\u0442\u044c \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0439 \u0441\u0432\u044f\u0437\u0438.\n\n\u041e\u0434\u043d\u0430\u043a\u043e \u0432 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u043c \u043e\u0431\u0440\u0430\u0437\u0435 Docker \u044d\u0442\u043e \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043d\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f, \u0432\u043c\u0435\u0441\u0442\u043e \u043d\u0435\u0433\u043e \u0436\u0435\u0441\u0442\u043a\u043e \u0437\u0430\u0434\u0430\u043d \u0441\u0438\u043c\u0432\u043e\u043b \"*\". \u0414\u0440\u0443\u0433\u0438\u043c\u0438 \u0441\u043b\u043e\u0432\u0430\u043c\u0438, \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u0432 \u0441\u043f\u0438\u0441\u043a\u0435 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0444\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442.\n\n\u0422\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u0435\u0441\u043b\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 ENABLE_REVERSE_PROXY_AUTHENTICATION = true, \u0447\u0442\u043e\u0431\u044b Gitea \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0438\u0439 \u043e\u0431\u0440\u0430\u0442\u043d\u044b\u0439 \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440, \u0438 \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 REVERSE_PROXY_TRUSTED_PROXIES \u0432 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, \u044d\u0442\u043e \u0440\u0430\u0437\u0440\u0435\u0448\u0430\u0435\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0439 HTTP-\u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043e\u043a X-WEBAUTH-USER \u0441 \u043b\u044e\u0431\u043e\u0433\u043e \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u0433\u043e IP, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0436\u0435\u0442 \u0434\u043e\u0441\u0442\u0438\u0447\u044c \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430.\n\n\u041b\u044e\u0431\u043e\u0439 \u043f\u0440\u043e\u0446\u0435\u0441\u0441, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0436\u0435\u0442 \u043d\u0430\u043f\u0440\u044f\u043c\u0443\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a HTTP-\u043f\u043e\u0440\u0442\u0443 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 Gitea - \u043d\u0435 \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u044b\u0439 \u0434\u043b\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440 - \u043c\u043e\u0436\u0435\u0442 \u0432\u044b\u0434\u0430\u0442\u044c \u0441\u0435\u0431\u044f \u0437\u0430 \u043b\u044e\u0431\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0447\u044c\u0435 \u0438\u043c\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e \u0438\u043b\u0438 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0443\u0433\u0430\u0434\u0430\u043d\u043e.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043e\u0431\u0440\u0430\u0437\u044b Docker Gitea \u0432\u0435\u0440\u0441\u0438\u0439 \u0434\u043e 1.26.2 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e. \u041e\u043d\u0430 \u0431\u044b\u043b\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 1.26.3, \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u0439 \u0432 \u043a\u043e\u043d\u0446\u0435 \u043f\u0440\u043e\u0448\u043b\u043e\u0433\u043e \u043c\u0435\u0441\u044f\u0446\u0430, \u0433\u0434\u0435 \u0431\u044b\u043b \u0443\u0434\u0430\u043b\u0435\u043d \u0441\u0438\u043c\u0432\u043e\u043b \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \"*\", \u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u0447\u0435\u0440\u0435\u0437 \u043e\u0431\u0440\u0430\u0442\u043d\u044b\u0439 \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440 \u0441\u0442\u0430\u043b\u0430 \u043d\u0435\u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0439.\n\nSysdig \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e\u0431 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0438 \u043f\u0435\u0440\u0432\u043e\u0439 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u0441\u043f\u0443\u0441\u0442\u044f 13 \u0434\u043d\u0435\u0439 \u043f\u043e\u0441\u043b\u0435 \u0435\u0435 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f. \u0420\u0435\u0447\u044c \u0438\u0434\u0435\u0442 \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u043e 6200 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0438\u0437 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0430 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u0430\u0445 Gitea.\n\n\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u043f\u0435\u0440\u0432\u044b\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441 IP-\u0430\u0434\u0440\u0435\u0441\u0430 \u0441\u0435\u0440\u0432\u0438\u0441\u0430 ProtonVPN, 159.26.98[.]241, \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u043d\u0435 \u043f\u0440\u0438\u0432\u0435\u043b\u0430 \u043a \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438\u043b\u0438 \u0430\u0442\u0430\u043a\u0435. \u041a\u0430\u043a \u0441\u0447\u0438\u0442\u0430\u044e\u0442 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438, \u044d\u0442\u043e \u0441\u0432\u044f\u0437\u0430\u043d\u043e \u0441 \u0442\u0435\u043c, \u0447\u0442\u043e \u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0431\u044b\u043b\u043e \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043e \u043d\u0430 \u0440\u0430\u043d\u043d\u0435\u0439 \u0441\u0442\u0430\u0434\u0438\u0438, \u0434\u043e \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u0430\u0442\u0430\u043a\u0430 \u0443\u0441\u043f\u0435\u043b\u0430 \u0440\u0430\u0437\u0432\u0438\u0442\u044c\u0441\u044f \u0434\u0430\u043b\u044c\u0448\u0435 \u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0439 \u0444\u0430\u0437\u044b.\n\n\u0423\u0447\u0438\u0442\u044b\u0432\u0430\u044f \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0438 \u043d\u0430\u0447\u0430\u0432\u0448\u0443\u044e\u0441\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e, \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u043a\u0440\u0430\u0439\u043d\u0435 \u0432\u0430\u0436\u043d\u043e \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0441\u043a\u043e\u0440\u0435\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u0438\u0442\u044c \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u043e\u043f\u0442\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u044b.", "creation_timestamp": "2026-07-14T00:00:47.212420Z"}, {"uuid": "3354f965-0e92-4e6c-862a-6408e221bf5d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "exploited", "source": "https://t.me/poxek/6232", "content": "CVE-2026-20896 \u0432 Gitea \u0443\u0436\u0435 \u043d\u0430\u0447\u0430\u043b\u0438 \u0434\u0435\u0440\u0433\u0430\u0442\u044c \u0432\u0436\u0438\u0432\u0443\u044e: \u043f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Sysdig, \u043f\u0435\u0440\u0432\u0430\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u044f\u0432\u0438\u043b\u0430\u0441\u044c \u0447\u0435\u0440\u0435\u0437 13 \u0434\u043d\u0435\u0439 \u043f\u043e\u0441\u043b\u0435 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f\n\n\u0412 Docker-\u0448\u0430\u0431\u043b\u043e\u043d\u0435 app.ini \u0431\u044b\u043b \u0434\u0435\u0444\u043e\u043b\u0442 REVERSE_PROXY_TRUSTED_PROXIES = *, \u0445\u043e\u0442\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u0434\u043e\u043b\u0436\u043d\u043e \u0434\u043e\u0432\u0435\u0440\u044f\u0442\u044c \u0442\u043e\u043b\u044c\u043a\u043e loopback. \u0415\u0441\u043b\u0438 \u0430\u0434\u043c\u0438\u043d \u0432\u043a\u043b\u044e\u0447\u0438\u043b ENABLE_REVERSE_PROXY_AUTHENTICATION \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0437\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0438\u043c reverse proxy \u0438 \u043f\u0440\u0438 \u044d\u0442\u043e\u043c HTTP-\u043f\u043e\u0440\u0442 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043d\u0430\u043f\u0440\u044f\u043c\u0443\u044e, \u043b\u044e\u0431\u043e\u0439 \u043a\u043b\u0438\u0435\u043d\u0442 \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0441\u043b\u0430\u0442\u044c X-WEBAUTH-USER: poxek \u0438 \u043f\u043e\u043f\u0430\u0441\u0442\u044c \u0432 Gitea \u043a\u0430\u043a poxek \u0431\u0435\u0437 \u043f\u0430\u0440\u043e\u043b\u044f \u0438 \u0442\u043e\u043a\u0435\u043d\u0430.\n\n\u267e\ufe0f\u0418\u043c\u043f\u0430\u043a\u0442\u267e\ufe0f\n\u0418\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0439 \u0438\u043b\u0438 \u0443\u0433\u0430\u0434\u044b\u0432\u0430\u0435\u043c\u044b\u0439 \u043b\u043e\u0433\u0438\u043d \u043f\u0440\u0435\u0432\u0440\u0430\u0449\u0430\u0435\u0442\u0441\u044f \u0432 \u0441\u0435\u0441\u0441\u0438\u044e \u044d\u0442\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u0414\u043b\u044f admin, gitea_admin \u0438 \u043f\u043e\u0445\u043e\u0436\u0438\u0445 \u0438\u043c\u0435\u043d \u044d\u0442\u043e \u0443\u0436\u0435 \u043f\u043e\u043b\u043d\u044b\u0439 takeover Gitea \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f: \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u044b\u0435 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438, \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438, \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438, packages, \u0440\u0435\u043b\u0438\u0437\u044b, \u0432\u0435\u0431\u0445\u0443\u043a\u0438 \u0438 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e downstream CI/CD. RCE \u043d\u0435 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0433\u0430\u0440\u0430\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0431\u043b\u0435\u043a\u0431\u043e\u043a\u0441 \u0438\u043c\u043f\u0430\u043a\u0442\u043e\u043c \u0441\u0430\u043c\u043e\u0439 CVE; \u0435\u0433\u043e \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u044f\u0432\u043b\u044f\u0442\u044c \u0442\u043e\u043b\u044c\u043a\u043e \u0435\u0441\u043b\u0438 \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u0430\u044f \u0438\u043d\u0441\u0442\u0430\u043b\u043b\u044f\u0446\u0438\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0434\u043e\u0439\u0442\u0438 \u0434\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0447\u0435\u0440\u0435\u0437 runner, \u0445\u0443\u043a\u0438, CI-\u0441\u0435\u043a\u0440\u0435\u0442\u044b \u0438\u043b\u0438 deployment-\u043f\u0430\u0439\u043f\u043b\u0430\u0439\u043d.\n\n\u267e\ufe0fPoC\u267e\ufe0f\n\u042f \u043d\u0435 \u043d\u0430\u0448\u0451\u043b \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0445 PoC, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u043d\u0430\u043f\u0438\u0441\u0430\u043b \u0441\u0432\u043e\u0439 \u0438 \u0432\u044b\u043b\u043e\u0436\u0438\u043b \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0439 PoC/\u0447\u0435\u043a\u0435\u0440: szybnev/cve-2026-20896-gitea-poc\n\n\u0412 \u0440\u0435\u043f\u0435 \u0435\u0441\u0442\u044c Go-\u0432\u0435\u0440\u0441\u0438\u044f \u0434\u043b\u044f \u043c\u0430\u0441\u0441\u043e\u0432\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0441 --targets, --user-file, --concurrency, --jsonl \u0438 --dry-run, \u043f\u043b\u044e\u0441 \u043f\u0440\u043e\u0441\u0442\u043e\u0439 Bash \u0441\u043a\u0440\u0438\u043f\u0442\u0438\u043a \u0431\u0435\u0437 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u0427\u0435\u043a\u0435\u0440 \u0441\u043d\u0430\u0447\u0430\u043b\u0430 \u043f\u0430\u0440\u0441\u0438\u0442 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0443 \u0438 \u043d\u0435 \u0444\u0430\u0437\u0437\u0438\u0442 usernames, \u0435\u0441\u043b\u0438 \u0432\u0438\u0434\u0438\u0442 Gitea >=1.26.3, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440 Powered by Gitea Version: 1.26.4. \u0414\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0439 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 1.26.2 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442 impersonation \u043f\u043e title dashboard \u0431\u0435\u0437 cookie \u0438 \u043f\u0430\u0440\u043e\u043b\u044f.\n\n\u267e\ufe0f\u041c\u0438\u0442\u0438\u0433\u0430\u0446\u0438\u044f\u267e\ufe0f\n\u25aa\ufe0f\u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c\u0441\u044f \u043c\u0438\u043d\u0438\u043c\u0443\u043c \u0434\u043e 1.26.3, \u043b\u0443\u0447\u0448\u0435 \u0434\u043e 1.26.4+;\n\u25aa\ufe0f\u043d\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u0442\u044c giea \u043d\u0430\u043f\u0440\u044f\u043c\u0443\u044e\n\u25aa\ufe0f\u044f\u0432\u043d\u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c trusted proxies\n\u25aa\ufe0f\u043d\u0435 \u0432\u043a\u043b\u044e\u0447\u0430\u0442\u044c reverse-proxy auth \u0431\u0435\u0437 \u043f\u043e\u043d\u044f\u0442\u043d\u043e\u0439 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0433\u0440\u0430\u043d\u0438\u0446\u044b\n\n\ud83d\udd17\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438:\nGHSA-f75j-4cw6-rmx4 / Gitea 1.26.3/1.26.4 release notes\nfix PR #38151 / CVE record\nSysdig telemetry via The Hacker News\n\n\ud83c\udf1a @poxek | \ud83c\udf1a @poxek_ai | \ud83d\udcf2 MAX", "creation_timestamp": "2026-07-14T00:00:47.940306Z"}, {"uuid": "11592fdc-c52a-463a-96d4-b2ae8191de95", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://bsky.app/profile/diesec.bsky.social/post/3mqm2hyngyx26", "content": "Gitea Docker CVE-2026-20896 (CVSS 9.8): one spoofed HTTP header = full admin access. ~6,200 exposed instances. Active exploitation confirmed. Patch to 1.26.4 now.\n\n\ud83c\uddec\ud83c\udde7 zurl.co/G9E8x\n\ud83c\udde9\ud83c\uddea zurl.co/KwwWP \n\n #CyberSecurity #Gitea #CVE", "creation_timestamp": "2026-07-14T11:00:04.968761Z"}, {"uuid": "2dac214c-1a3c-4512-9ceb-b040bb766354", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://t.me/TengkorakCyberCrewzz/11653", "content": "Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure \u2013 thehackernews.com\n\nTue, 07 Jul 2026 00:28:59", "creation_timestamp": "2026-07-14T12:00:04.742409Z"}, {"uuid": "f369bc48-267a-4806-bb67-012b8a229f1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://t.me/ctinow/252886", "content": "Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure\nhttps://ift.tt/Z1IT7qt", "creation_timestamp": "2026-07-14T14:00:04.759431Z"}, {"uuid": "7f251082-3149-4506-8c95-0ddbf27cb044", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://t.me/cibsecurity/89930", "content": "\ud83d\udd8b\ufe0f Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure \ud83d\udd8b\ufe0f\n\nThreat actors have been observed attempting to exploit a recently patched critical security flaw in Gitea Docker images, according to Sysdig.  The vulnerability in question is CVE202620896 CVSS score 9.8, a vulnerability that stems from the DevOps platform trusting the \"XWEBAUTHUSER\" header from any source IP address, effectively allowing an unauthenticated internet client to get elevated.\n\n\ud83d\udcd6 Read more.\n\n\ud83d\udd17 Via \"The Hacker News\"\n\n----------\n\ud83d\udc41\ufe0f Seen on @cibsecurity", "creation_timestamp": "2026-07-14T14:00:05.432863Z"}, {"uuid": "162462d6-34d4-41df-90a8-47fc1a531504", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://t.me/TengkorakCyberCrewzz/11653", "content": "Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure \u2013 thehackernews.com\n\nTue, 07 Jul 2026 00:28:59", "creation_timestamp": "2026-07-15T00:00:25.188986Z"}, {"uuid": "fd9f6e10-6fff-4bd0-8592-08e03c49b19e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "exploited", "source": "https://t.me/cibsecurity/89930", "content": "\ud83d\udd8b\ufe0f Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure \ud83d\udd8b\ufe0f\n\nThreat actors have been observed attempting to exploit a recently patched critical security flaw in Gitea Docker images, according to Sysdig.  The vulnerability in question is CVE202620896 CVSS score 9.8, a vulnerability that stems from the DevOps platform trusting the \"XWEBAUTHUSER\" header from any source IP address, effectively allowing an unauthenticated internet client to get elevated.\n\n\ud83d\udcd6 Read more.\n\n\ud83d\udd17 Via \"The Hacker News\"\n\n----------\n\ud83d\udc41\ufe0f Seen on @cibsecurity", "creation_timestamp": "2026-07-15T00:00:22.656836Z"}, {"uuid": "948eb3c7-9796-474b-8cfd-86ed33264a9b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://t.me/ctinow/252886", "content": "Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure\nhttps://ift.tt/Z1IT7qt", "creation_timestamp": "2026-07-15T00:00:23.392630Z"}, {"uuid": "19e6b3fd-15b7-4cc2-8305-3e602838b41f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://t.me/GithubRedTeam/91524", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-20896\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a kaleth4\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-02 00:23:50\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-15T00:00:26.112650Z"}, {"uuid": "d7566fc2-c728-43ec-bf26-31547c4bb856", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/92061", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-20896\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a rz1027\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-05 15:52:46\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPublic PoC and detector for CVE-2026-20896 (\"Gitea Docker: One Header, Any User\")\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-15T00:00:29.628301Z"}, {"uuid": "095ff95a-493e-4c21-8c2a-04fd5f1f99a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/92405", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-20896-gitea-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a szybnev\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Go\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-07 20:31:29\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-20896 Gitea Docker X-WEBAUTH-USER auth bypass checker\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-15T00:00:31.635263Z"}, {"uuid": "3c9d5f27-a0fc-425b-8b95-d883cc28c04a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "exploited", "source": "https://t.me/thehackernews/9422", "content": "\ud83d\udea8 CVE-2026-20896 saw its first in-the-wild attempt 13 days after disclosure.\n\nThe Gitea Docker flaw lets reachable containers trust spoofed X-WEBAUTH-USER headers when reverse proxy auth is enabled.\n\nSee which setups are exposed and where the probe stopped: https://thehackernews.com/2026/07/threat-actors-probe-gitea-docker-flaw.html", "creation_timestamp": "2026-07-15T12:00:03.977493Z"}, {"uuid": "1d3d9627-cc0b-4498-8515-9a5583745045", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://t.me/information_security_channel/55535", "content": "Critical Gitea Flaw Under Active Exploitation, Researchers Warn\nhttps://www.securityweek.com/critical-gitea-flaw-under-active-exploitation-researchers-warn/\n\nAttackers are exploiting the critical Gitea vulnerability CVE-2026-20896 to bypass authentication with a single HTTP header and access vulnerable repositories and secrets.\nThe post Critical Gitea Flaw Under Active Exploitation, Researchers Warn (https://www.securityweek.com/critical-gitea-flaw-under-active-exploitation-researchers-warn/) appeared first on SecurityWeek (https://www.securityweek.com/).", "creation_timestamp": "2026-07-15T12:00:06.101989Z"}, {"uuid": "6996069e-433d-421e-a56c-97ef6e05283f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "exploited", "source": "https://t.me/information_security_channel/55535", "content": "Critical Gitea Flaw Under Active Exploitation, Researchers Warn\nhttps://www.securityweek.com/critical-gitea-flaw-under-active-exploitation-researchers-warn/\n\nAttackers are exploiting the critical Gitea vulnerability CVE-2026-20896 to bypass authentication with a single HTTP header and access vulnerable repositories and secrets.\nThe post Critical Gitea Flaw Under Active Exploitation, Researchers Warn (https://www.securityweek.com/critical-gitea-flaw-under-active-exploitation-researchers-warn/) appeared first on SecurityWeek (https://www.securityweek.com/).", "creation_timestamp": "2026-07-16T00:00:08.523982Z"}, {"uuid": "86fe0ab4-53c3-4e98-a22b-1f3c7484284a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "exploited", "source": "https://t.me/thehackernews/9422", "content": "\ud83d\udea8 CVE-2026-20896 saw its first in-the-wild attempt 13 days after disclosure.\n\nThe Gitea Docker flaw lets reachable containers trust spoofed X-WEBAUTH-USER headers when reverse proxy auth is enabled.\n\nSee which setups are exposed and where the probe stopped: https://thehackernews.com/2026/07/threat-actors-probe-gitea-docker-flaw.html", "creation_timestamp": "2026-07-16T00:00:19.731481Z"}, {"uuid": "cc7794f6-6fc0-441c-96ea-a37c5853769e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://t.me/GithubRedTeam/93701", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-20896\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a XaocZenon\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-16 13:59:08\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nthis is a modified POC of rz1027 for CVE-2026-20896\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-16T15:00:03.657183Z"}, {"uuid": "f576ad9a-5bb3-4e99-9250-64cefcdf055b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "Telegram/CnEki5hq44Oxm0CoGoLc7kB7HOehG1kiHXYcZhaPM81wL2c", "content": "", "creation_timestamp": "2026-07-16T19:00:21.302120Z"}, {"uuid": "701b7bbc-920f-486b-96a3-f344ce748c27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "Telegram/Ar6VYUXodzKxiDS_suM4v32kyWX2cdNc6MzI7nJflxEqdTk", "content": "", "creation_timestamp": "2026-07-16T19:00:17.537820Z"}, {"uuid": "638d7877-149f-493a-90f7-eb2107404b0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "Telegram/7rIIDruJxEl38qBzoHyGM9oWQAxjhN2Km_TAbaElw9hJXAI", "content": "", "creation_timestamp": "2026-07-16T19:00:21.433254Z"}, {"uuid": "c2bb21bb-cb59-44f7-ac53-3e92ec2e7801", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "Telegram/TB3sUB_uu5WF_jRq8K66TTyRIaSSs7xyuOpmS1TasPtzRF4", "content": "", "creation_timestamp": "2026-07-16T19:00:24.948029Z"}, {"uuid": "b6091578-bbc9-4411-93cb-2015834ad1e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "Telegram/CnEki5hq44Oxm0CoGoLc7kB7HOehG1kiHXYcZhaPM81wL2c", "content": "", "creation_timestamp": "2026-07-17T00:00:37.723414Z"}, {"uuid": "d333b895-1b53-4b6e-a45b-6af4917022e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "Telegram/7rIIDruJxEl38qBzoHyGM9oWQAxjhN2Km_TAbaElw9hJXAI", "content": "", "creation_timestamp": "2026-07-17T00:00:37.851384Z"}, {"uuid": "d254defd-d7bc-44ed-aaf5-8b73397b96e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "Telegram/Ar6VYUXodzKxiDS_suM4v32kyWX2cdNc6MzI7nJflxEqdTk", "content": "", "creation_timestamp": "2026-07-17T01:00:15.466174Z"}, {"uuid": "d8100755-9ac5-4ff6-b377-6ccec5bc3397", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "Telegram/TB3sUB_uu5WF_jRq8K66TTyRIaSSs7xyuOpmS1TasPtzRF4", "content": "", "creation_timestamp": "2026-07-17T00:00:41.163521Z"}, {"uuid": "68a8e619-3b43-4655-96c5-48ede58eb6e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://t.me/GithubRedTeam/98223", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Exploit #CVE #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-20896-Gitea-Authentication-Bypass\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a judgedbykira\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-15 19:05:05\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nAn explanation and PoC to exploit CVE-2026-20896 Authentication Bypass Vulnerability on Gitea. Being able to steal session tokens for valid users in the Gitea instance.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-22T19:00:09.720174Z"}, {"uuid": "13b69882-7e60-4149-9ebe-ae723f37ed04", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/93701", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-20896\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a XaocZenon\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-16 13:59:08\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nthis is a modified POC of rz1027 for CVE-2026-20896\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-17T00:00:51.999827Z"}, {"uuid": "4088baa2-4d5f-411e-941c-012b8c0ac4f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "published-proof-of-concept", "source": "Telegram/TB3sUB_uu5WF_jRq8K66TTyRIaSSs7xyuOpmS1TasPtzRF4", "content": "", "creation_timestamp": "2026-07-18T00:00:10.050647Z"}, {"uuid": "9b07067e-76d3-4763-974e-3f2c5dd9fb95", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "published-proof-of-concept", "source": "Telegram/Ar6VYUXodzKxiDS_suM4v32kyWX2cdNc6MzI7nJflxEqdTk", "content": "", "creation_timestamp": "2026-07-18T00:00:26.512074Z"}, {"uuid": "90c31f31-094e-496d-a4c3-600486154646", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "published-proof-of-concept", "source": "Telegram/CnEki5hq44Oxm0CoGoLc7kB7HOehG1kiHXYcZhaPM81wL2c", "content": "", "creation_timestamp": "2026-07-18T00:00:22.741751Z"}, {"uuid": "f15361f7-9807-4b14-8df6-c15309c7c37f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "published-proof-of-concept", "source": "Telegram/7rIIDruJxEl38qBzoHyGM9oWQAxjhN2Km_TAbaElw9hJXAI", "content": "", "creation_timestamp": "2026-07-18T00:00:22.823375Z"}, {"uuid": "4a049c46-2118-4ba1-9566-f050b4fc85b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "Telegram/Xr3h-QZd7nLUl6cH2ZkYAyeJW2qp_-enFsFogeXUHPpGcg", "content": "", "creation_timestamp": "2026-07-18T13:00:04.487472Z"}, {"uuid": "a7b42857-6ef0-44f7-8c26-f2dac6516c47", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "exploited", "source": "Telegram/Xr3h-QZd7nLUl6cH2ZkYAyeJW2qp_-enFsFogeXUHPpGcg", "content": "", "creation_timestamp": "2026-07-19T00:00:27.597100Z"}, {"uuid": "d4a484e6-17c0-4ac0-acb2-39a98aa3fe1d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://t.me/MalaysiaHacktivistz/22841", "content": "Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure \u2013 thehackernews.com\n\nTue, 07 Jul 2026 00:28:59", "creation_timestamp": "2026-07-19T16:00:04.656337Z"}, {"uuid": "53bd2c67-8b4e-475d-87e7-02ce77adf5d9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://t.me/GithubRedTeam/98223", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Exploit #CVE #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-20896-Gitea-Authentication-Bypass\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a judgedbykira\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-15 19:05:05\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nAn explanation and PoC to exploit CVE-2026-20896 Authentication Bypass Vulnerability on Gitea. Being able to steal session tokens for valid users in the Gitea instance.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-23T00:00:33.173887Z"}, {"uuid": "879e9741-c635-4b21-8a19-329e2e3d8df6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "exploited", "source": "https://t.me/MalaysiaHacktivistz/22841", "content": "Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure \u2013 thehackernews.com\n\nTue, 07 Jul 2026 00:28:59", "creation_timestamp": "2026-07-20T00:00:22.602053Z"}, {"uuid": "e12161ad-f58e-4b32-97e9-4c7da745a8ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "Telegram/QkQGfXHJmhlUJ4Ok72ZW64yVSosDBVIcN9uDsRFq_Gn2BWo", "content": "", "creation_timestamp": "2026-07-20T18:00:12.950855Z"}, {"uuid": "15fb8aff-9a8d-4541-ae8f-145253ccb10e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "Telegram/hIPenhe-vO-uZm0FZ9_PgTXttBSRhFyvx9XOlO5pcs6kI4c", "content": "", "creation_timestamp": "2026-07-20T18:00:13.217905Z"}, {"uuid": "7df7c430-99f0-4c8a-b9f0-123d1c39490a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "Telegram/QkQGfXHJmhlUJ4Ok72ZW64yVSosDBVIcN9uDsRFq_Gn2BWo", "content": "", "creation_timestamp": "2026-07-21T00:00:35.599273Z"}, {"uuid": "b58d12a5-b295-45e7-b8d8-ebff68d1d6e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "Telegram/hIPenhe-vO-uZm0FZ9_PgTXttBSRhFyvx9XOlO5pcs6kI4c", "content": "", "creation_timestamp": "2026-07-21T00:00:36.097957Z"}, {"uuid": "6a04099e-95c1-4e5a-a6e5-4429e1dc8fd4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-20896", "type": "published-proof-of-concept", "source": "https://github.com/go-gitea/gitea/security/advisories/GHSA-f75j-4cw6-rmx4", "content": "", "creation_timestamp": "2026-07-21T22:36:58.280570Z"}, {"uuid": "48a9c1d6-43df-4058-964d-e94b00a48ca9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "published-proof-of-concept", "source": "Telegram/QkQGfXHJmhlUJ4Ok72ZW64yVSosDBVIcN9uDsRFq_Gn2BWo", "content": "", "creation_timestamp": "2026-07-22T00:00:03.965954Z"}, {"uuid": "b1e01fdc-6424-4049-b8dd-fcce08ebcddf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "published-proof-of-concept", "source": "Telegram/hIPenhe-vO-uZm0FZ9_PgTXttBSRhFyvx9XOlO5pcs6kI4c", "content": "", "creation_timestamp": "2026-07-22T00:00:03.594838Z"}, {"uuid": "a400bc43-8296-4255-8c89-83ecce57a871", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-20896", "type": "seen", "source": "https://bsky.app/profile/etairos-ai.bsky.social/post/3mraw36unbi2l", "content": "One HTTP header is all it takes: CVE-2026-20896, a critical auth bypass in Gitea Docker images, is under active exploitation. Full admin, no credentials. Patch now. #ThreatIntel #CyberSecurity\nhttps://threat-intelligence.redeyesecurity.com/blog/gitea-docker-auth-bypass-cve-2026-20896-exploited-2026", "creation_timestamp": "2026-07-22T18:07:14.781185Z"}, {"uuid": "59993fdc-5243-4432-9183-2421f07dd39d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "exploited", "source": "https://t.me/true_secator/8549", "content": "CISA \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u0435\u0442, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0441\u0430\u043c\u043e\u0440\u0430\u0437\u043c\u0435\u0449\u0430\u0435\u043c\u043e\u043c \u0441\u0435\u0440\u0432\u0438\u0441\u0435 Git Gitea.\n\n\u041f\u043e\u0434\u043e\u0431\u043d\u043e \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u043c \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430\u043c GitHub \u0438\u043b\u0438 GitLab SaaS, Gitea \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u043d\u044b\u0439 \u043d\u0430\u0431\u043e\u0440 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 DevOps, \u043d\u043e \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u0430 \u0434\u043b\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0434\u043b\u044f \u0441\u0430\u043c\u043e\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u041f\u041e.\n\n\u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u0430\u044f \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c Salesforce \u0428\u0430\u0435\u043c \u0420\u043e\u0434\u043e\u043c CVE-2026-60004 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u043d\u0430 \u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438, \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u043d\u044b\u0435 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0438 \u0441 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0441\u043b\u0443\u0436\u0431\u044b Gitea, \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u043f\u0430\u0442\u0447\u0438 \u0447\u0435\u0440\u0435\u0437 \u043a\u043e\u043d\u0435\u0447\u043d\u0443\u044e \u0442\u043e\u0447\u043a\u0443 API diffpatch.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u0445 Gitea \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0430 \u0441\u0430\u043c\u043e\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u044f, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0443\u0447\u0435\u0442\u043d\u0443\u044e \u0437\u0430\u043f\u0438\u0441\u044c, \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u043d\u043e\u0432\u044b\u0439 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 \u0438 \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u0435\u0437 \u043f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445.\n\n\u041a\u0430\u043a \u043f\u043e\u044f\u0441\u043d\u044f\u044e\u0442 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438, \u043a\u043e\u043d\u0435\u0447\u043d\u0430\u044f \u0442\u043e\u0447\u043a\u0430 diffpatch \u0432 Gitea \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0434\u043b\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f Git-\u0445\u0443\u043a\u0430 \u0438\u0437 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u043e\u0433\u043e \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u043c.\n\n\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a, \u0438\u043c\u0435\u044e\u0449\u0438\u0439 \u043e\u0431\u044b\u0447\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043d\u0430 \u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439, \u043c\u043e\u0436\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0438 \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Gitea.\n\n\u041f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043f\u043e\u0441\u0435\u0442\u0438\u0442\u0435\u043b\u044c \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u044b\u0435 \u043f\u0440\u0430\u0432\u0430 \u043d\u0430 \u0437\u0430\u043f\u0438\u0441\u044c, \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u0432 \u0443\u0447\u0435\u0442\u043d\u0443\u044e \u0437\u0430\u043f\u0438\u0441\u044c \u0438 \u0441\u043e\u0437\u0434\u0430\u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439.\n\nGitea \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 27 \u0438\u044e\u043b\u044f 1.27.1 \u0434\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f CVE-2026-60004, \u043f\u043e\u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u043e\u0432\u0430\u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0441\u043a\u043e\u0440\u0435\u0435 \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u044b.\n\n\u0412 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0432\u0440\u0435\u043c\u044f Shadowserver, \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u0442\u00a0\u043e\u043a\u043e\u043b\u043e 5000 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u043e\u0432 Gitea, \u043d\u0430\u0445\u043e\u0434\u044f\u0449\u0438\u0445\u0441\u044f \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435 \u0432 \u0441\u0435\u0442\u0438. \u041e\u0434\u043d\u0430\u043a\u043e \u043d\u0435\u0442 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e \u0442\u043e\u043c, \u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0438\u0437 \u043d\u0438\u0445 \u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u0445\u0430\u043d\u0438\u043f\u043e\u0442\u0430\u043c\u0438 \u0438\u043b\u0438 \u0443\u0436\u0435 \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u044b \u043e\u0442 \u0430\u0442\u0430\u043a CVE-2026-60004.\n\n\u0412\u043e \u0432\u0442\u043e\u0440\u043d\u0438\u043a CISA\u00a0\u0434\u043e\u0431\u0430\u0432\u0438\u043b\u0430\u00a0\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0441\u0432\u043e\u0439 \u043a\u0430\u0442\u0430\u043b\u043e\u0433 KEV, \u043d\u0435 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u0438\u0432 \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u043d\u0438\u043a\u0430\u043a\u0438\u0445 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0435\u0439 \u043e\u0431 \u0430\u0442\u0430\u043a\u0430\u0445, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u043d\u0430 \u044d\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c. \n\n\u041f\u043e \u0432\u0441\u0435\u0439 \u0432\u0438\u0434\u0438\u043c\u043e\u0441\u0442\u0438, \u0442\u0440\u0438\u0433\u0433\u0435\u0440\u043e\u043c \u0441\u0442\u0430\u043b\u0438 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u043e\u0431 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445,\u00a0\u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u0443\u043f\u043e\u043c\u0438\u043d\u0430\u043d\u0438\u0435\u043c \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0440\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u043b\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0434\u043b\u044f \u043c\u0430\u0439\u043d\u0438\u043d\u0433\u0430 \u043a\u0440\u0438\u043f\u0442\u043e\u0432\u0430\u043b\u044e\u0442\u044b \u043d\u0430 \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 Gitea.\n\n\u0420\u0430\u043d\u0435\u0435 \u0432 \u0438\u044e\u043b\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0442\u0430\u043a\u0436\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0431\u0445\u043e\u0434\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 Gitea (CVE-2026-20896) \u0432 \u0430\u0442\u0430\u043a\u0430\u0445 \u043d\u0430 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u044b Gitea \u0441 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u044b\u043c\u0438 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0430\u043c\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u043a\u0441\u0438, \u0442\u0430\u043a\u0438\u043c\u0438 \u043a\u0430\u043a X-WEBAUTH-USER.", "creation_timestamp": "2026-08-28T00:01:01.964341Z"}, {"uuid": "0f7a2f79-3b35-45d4-845a-94da2f633807", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://t.me/true_secator/8549", "content": "CISA \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u0435\u0442, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0441\u0430\u043c\u043e\u0440\u0430\u0437\u043c\u0435\u0449\u0430\u0435\u043c\u043e\u043c \u0441\u0435\u0440\u0432\u0438\u0441\u0435 Git Gitea.\n\n\u041f\u043e\u0434\u043e\u0431\u043d\u043e \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u043c \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430\u043c GitHub \u0438\u043b\u0438 GitLab SaaS, Gitea \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u043d\u044b\u0439 \u043d\u0430\u0431\u043e\u0440 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 DevOps, \u043d\u043e \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u0430 \u0434\u043b\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0434\u043b\u044f \u0441\u0430\u043c\u043e\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u041f\u041e.\n\n\u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u0430\u044f \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c Salesforce \u0428\u0430\u0435\u043c \u0420\u043e\u0434\u043e\u043c CVE-2026-60004 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u043d\u0430 \u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438, \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u043d\u044b\u0435 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0438 \u0441 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0441\u043b\u0443\u0436\u0431\u044b Gitea, \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u043f\u0430\u0442\u0447\u0438 \u0447\u0435\u0440\u0435\u0437 \u043a\u043e\u043d\u0435\u0447\u043d\u0443\u044e \u0442\u043e\u0447\u043a\u0443 API diffpatch.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u0445 Gitea \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0430 \u0441\u0430\u043c\u043e\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u044f, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0443\u0447\u0435\u0442\u043d\u0443\u044e \u0437\u0430\u043f\u0438\u0441\u044c, \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u043d\u043e\u0432\u044b\u0439 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 \u0438 \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u0435\u0437 \u043f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445.\n\n\u041a\u0430\u043a \u043f\u043e\u044f\u0441\u043d\u044f\u044e\u0442 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438, \u043a\u043e\u043d\u0435\u0447\u043d\u0430\u044f \u0442\u043e\u0447\u043a\u0430 diffpatch \u0432 Gitea \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0434\u043b\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f Git-\u0445\u0443\u043a\u0430 \u0438\u0437 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u043e\u0433\u043e \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u043c.\n\n\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a, \u0438\u043c\u0435\u044e\u0449\u0438\u0439 \u043e\u0431\u044b\u0447\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043d\u0430 \u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439, \u043c\u043e\u0436\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0438 \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Gitea.\n\n\u041f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043f\u043e\u0441\u0435\u0442\u0438\u0442\u0435\u043b\u044c \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u044b\u0435 \u043f\u0440\u0430\u0432\u0430 \u043d\u0430 \u0437\u0430\u043f\u0438\u0441\u044c, \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u0432 \u0443\u0447\u0435\u0442\u043d\u0443\u044e \u0437\u0430\u043f\u0438\u0441\u044c \u0438 \u0441\u043e\u0437\u0434\u0430\u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439.\n\nGitea \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 27 \u0438\u044e\u043b\u044f 1.27.1 \u0434\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f CVE-2026-60004, \u043f\u043e\u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u043e\u0432\u0430\u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0441\u043a\u043e\u0440\u0435\u0435 \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u044b.\n\n\u0412 \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0432\u0440\u0435\u043c\u044f Shadowserver, \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u0442\u00a0\u043e\u043a\u043e\u043b\u043e 5000 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u043e\u0432 Gitea, \u043d\u0430\u0445\u043e\u0434\u044f\u0449\u0438\u0445\u0441\u044f \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435 \u0432 \u0441\u0435\u0442\u0438. \u041e\u0434\u043d\u0430\u043a\u043e \u043d\u0435\u0442 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e \u0442\u043e\u043c, \u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0438\u0437 \u043d\u0438\u0445 \u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u0445\u0430\u043d\u0438\u043f\u043e\u0442\u0430\u043c\u0438 \u0438\u043b\u0438 \u0443\u0436\u0435 \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u044b \u043e\u0442 \u0430\u0442\u0430\u043a CVE-2026-60004.\n\n\u0412\u043e \u0432\u0442\u043e\u0440\u043d\u0438\u043a CISA\u00a0\u0434\u043e\u0431\u0430\u0432\u0438\u043b\u0430\u00a0\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0441\u0432\u043e\u0439 \u043a\u0430\u0442\u0430\u043b\u043e\u0433 KEV, \u043d\u0435 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u0438\u0432 \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u043d\u0438\u043a\u0430\u043a\u0438\u0445 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0435\u0439 \u043e\u0431 \u0430\u0442\u0430\u043a\u0430\u0445, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u043d\u0430 \u044d\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c. \n\n\u041f\u043e \u0432\u0441\u0435\u0439 \u0432\u0438\u0434\u0438\u043c\u043e\u0441\u0442\u0438, \u0442\u0440\u0438\u0433\u0433\u0435\u0440\u043e\u043c \u0441\u0442\u0430\u043b\u0438 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u043e\u0431 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445,\u00a0\u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u0443\u043f\u043e\u043c\u0438\u043d\u0430\u043d\u0438\u0435\u043c \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0440\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u043b\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0434\u043b\u044f \u043c\u0430\u0439\u043d\u0438\u043d\u0433\u0430 \u043a\u0440\u0438\u043f\u0442\u043e\u0432\u0430\u043b\u044e\u0442\u044b \u043d\u0430 \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 Gitea.\n\n\u0420\u0430\u043d\u0435\u0435 \u0432 \u0438\u044e\u043b\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0442\u0430\u043a\u0436\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0431\u0445\u043e\u0434\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 Gitea (CVE-2026-20896) \u0432 \u0430\u0442\u0430\u043a\u0430\u0445 \u043d\u0430 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u044b Gitea \u0441 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u044b\u043c\u0438 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0430\u043c\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u043a\u0441\u0438, \u0442\u0430\u043a\u0438\u043c\u0438 \u043a\u0430\u043a X-WEBAUTH-USER.", "creation_timestamp": "2026-08-27T00:00:06.911368Z"}, {"uuid": "5ca6d2b5-891d-4dfd-8c72-3275c3c3b7bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-20896", "type": "seen", "source": "https://gist.github.com/cyberupdates365/bf7660f4ca560d30158b5e5aa5986267", "content": "# 2026 Active CVE and Patch Index\n\nMaster Quick-Reference Index of official mitigation steps and investigative threat reports by **[CyberUpdates365.com](https://cyberupdates365.com/)**.\n\n* **[Adobe Coldfusion Cve 2026 48282 Exploited Guide (2026)](https://cyberupdates365.com/adobe-coldfusion-cve-2026-48282-exploited/)**\n* **[Adobe Vulnerability United States Cisa Emergency Alert October 2025 Guide (2026)](https://cyberupdates365.com/adobe-vulnerability-united-states-cisa-emergency-alert-october-2025/)**\n* **[Beyondtrust Cve 2026 40138 40139 Auth Bypass Guide (2026)](https://cyberupdates365.com/beyondtrust-cve-2026-40138-40139-auth-bypass/)**\n* **[Bind9 Resolver Cache Poisoning Vulnerability Guide (2026)](https://cyberupdates365.com/bind9-resolver-cache-poisoning-vulnerability/)**\n* **[Bind 9 Vulnerability Poc Exploit Released Guide (2026)](https://cyberupdates365.com/bind-9-vulnerability-poc-exploit-released/)**\n* **[Chinese Hackers Cisco Zero Day Cisa Emergency Directive 2025 Guide (2026)](https://cyberupdates365.com/chinese-hackers-cisco-zero-day-cisa-emergency-directive-2025/)**\n* **[Cisco Asa Zero Day Rce Vulnerability Actively Exploited Guide (2026)](https://cyberupdates365.com/cisco-asa-zero-day-rce-vulnerability-actively-exploited/)**\n* **[Cve 2025 22225 Vmware Esxi Sandbox Escape Guide (2026)](https://cyberupdates365.com/cve-2025-22225-vmware-esxi-sandbox-escape/)**\n* **[Cve 2026 20896 Gitea Docker Auth Bypass Fix Guide (2026)](https://cyberupdates365.com/cve-2026-20896-gitea-docker-auth-bypass-fix/)**\n* **[Cve 2026 35273 Oracle Peoplesoft Shinyhunters Attack Guide (2026)](https://cyberupdates365.com/cve-2026-35273-oracle-peoplesoft-shinyhunters-attack/)**\n* **[Cve Vulnerabilities 2026 Enterprise Security Hub Guide (2026)](https://cyberupdates365.com/cve-vulnerabilities-2026-enterprise-security-hub/)**\n* **[Google Chrome Zero Day Emergency Update 2026 Guide (2026)](https://cyberupdates365.com/google-chrome-zero-day-emergency-update-2026/)**\n* **[Legacyhive Windows Zero Day Profsvc Fix Guide (2026)](https://cyberupdates365.com/legacyhive-windows-zero-day-profsvc-fix/)**\n* **[Roundcube Cve 2024 42009 Chinese Hackers Exploit Guide (2026)](https://cyberupdates365.com/roundcube-cve-2024-42009-chinese-hackers-exploit/)**\n* **[Samsung Galaxy S25 Zero Day Vulnerability Guide (2026)](https://cyberupdates365.com/samsung-galaxy-s25-zero-day-vulnerability/)**\n* **[Sharepoint Cve 2026 45659 Rce Vulnerability Guide (2026)](https://cyberupdates365.com/sharepoint-cve-2026-45659-rce-vulnerability/)**\n* **[Simplehelp Cve 2026 48558 Rmm Vulnerability Guide (2026)](https://cyberupdates365.com/simplehelp-cve-2026-48558-rmm-vulnerability/)**\n* **[Splunk Enterprise Critical Vulnerability Cve 2026 20253 Guide (2026)](https://cyberupdates365.com/splunk-enterprise-critical-vulnerability-cve-2026-20253/)**\n* **[Windows 11 Recall Vulnerability Totalrecall Reloaded Guide (2026)](https://cyberupdates365.com/windows-11-recall-vulnerability-totalrecall-reloaded/)**\n* **[Wordpress Arbitrary Installation Vulnerabilities Exploited Guide (2026)](https://cyberupdates365.com/wordpress-arbitrary-installation-vulnerabilities-exploited/)**\n* **[Wp2shell Wordpress Vulnerability Fix Guide Guide (2026)](https://cyberupdates365.com/wp2shell-wordpress-vulnerability-fix-guide/)**\n* **[Wsus Rce Vulnerability United States Cve 2025 59287 Critical Security Alert Guide (2026)](https://cyberupdates365.com/wsus-rce-vulnerability-united-states-cve-2025-59287-critical-security-alert/)**\n", "creation_timestamp": "2026-07-25T08:57:56.350224Z"}, {"uuid": "31e1f548-87e5-465a-a5b4-5325473e1737", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "seen", "source": "https://t.me/ZerodayAlert/753", "content": "\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0440\u0430\u0437\u0432\u0435\u0434\u044b\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u0430\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 Gitea\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-20896 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H \u2014 9.8 Critical) \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 Docker-\u043e\u0431\u0440\u0430\u0437\u044b Gitea \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 1.26.2 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u043e\u0437\u043d\u0438\u043a\u043b\u0430 \u0438\u0437-\u0437\u0430 \u0442\u043e\u0433\u043e, \u0447\u0442\u043e \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0445 \u043f\u0440\u043e\u043a\u0441\u0438 \u0432 \u0448\u0430\u0431\u043b\u043e\u043d\u0435 app.ini \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0437\u0430\u0434\u0430\u043b\u0438 \u043a\u0430\u043a \u00ab*\u00bb, \u0438\u0437-\u0437\u0430 \u0447\u0435\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440 \u0434\u043e\u0432\u0435\u0440\u044f\u043b \u0437\u0430\u043f\u0440\u043e\u0441\u0430\u043c \u0441 \u043b\u044e\u0431\u043e\u0433\u043e IP-\u0430\u0434\u0440\u0435\u0441\u0430.\n\n\u0415\u0441\u043b\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440 \u0432\u043a\u043b\u044e\u0447\u0430\u043b \u0432\u0445\u043e\u0434 \u0447\u0435\u0440\u0435\u0437 \u043e\u0431\u0440\u0430\u0442\u043d\u044b\u0439 \u043f\u0440\u043e\u043a\u0441\u0438, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0433 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0439 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043e\u043a X-WEBAUTH-USER \u0438 \u0432\u044b\u0434\u0430\u0442\u044c \u0441\u0435\u0431\u044f \u0437\u0430 \u043b\u044e\u0431\u043e\u0433\u043e \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0433\u043e \u0438\u043b\u0438 \u0443\u0433\u0430\u0434\u0430\u043d\u043d\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0431\u0435\u0437 \u043f\u0430\u0440\u043e\u043b\u044f \u0438 \u0442\u043e\u043a\u0435\u043d\u0430. \u041f\u0440\u0438 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u043e\u0439 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u0438 \u0438\u043c\u044f \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0434\u0430\u0432\u0430\u043b\u043e \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u043f\u0440\u0430\u0432\u0430 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Sysdig, \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u043f\u043e\u043f\u044b\u0442\u0430\u043b\u0438\u0441\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0447\u0435\u0440\u0435\u0437 13 \u0434\u043d\u0435\u0439 \u043f\u043e\u0441\u043b\u0435 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b, \u0430\u0442\u0430\u043a\u0430 \u0448\u043b\u0430 \u0441 IP-\u0430\u0434\u0440\u0435\u0441\u0430 \u0441\u0435\u0440\u0432\u0438\u0441\u0430 \u0430\u043d\u043e\u043d\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u0438 \u0442\u0440\u0430\u0444\u0438\u043a\u0430. Gitea \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 1.26.3 \u0432 \u043a\u043e\u043d\u0446\u0435 \u0438\u044e\u043d\u044f, \u0443\u0431\u0440\u0430\u0432 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u0447\u043d\u044b\u0439 \u0441\u0438\u043c\u0432\u043e\u043b \u00ab*\u00bb \u0438 \u0441\u0434\u0435\u043b\u0430\u0432 \u0432\u0445\u043e\u0434 \u0447\u0435\u0440\u0435\u0437 \u043e\u0431\u0440\u0430\u0442\u043d\u044b\u0439 \u043f\u0440\u043e\u043a\u0441\u0438 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e\u0439 \u043e\u043f\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u0435\u0439.\n\n#gitea #\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c #docker #Sysdig\n\n@ZerodayAlert", "creation_timestamp": "2026-07-25T15:00:05.697531Z"}, {"uuid": "fdf100f8-4dd4-4d63-82cc-72728be317f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "exploited", "source": "https://t.me/ZerodayAlert/753", "content": "\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0440\u0430\u0437\u0432\u0435\u0434\u044b\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u0430\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 Gitea\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-20896 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H \u2014 9.8 Critical) \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 Docker-\u043e\u0431\u0440\u0430\u0437\u044b Gitea \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 1.26.2 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u043e\u0437\u043d\u0438\u043a\u043b\u0430 \u0438\u0437-\u0437\u0430 \u0442\u043e\u0433\u043e, \u0447\u0442\u043e \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0445 \u043f\u0440\u043e\u043a\u0441\u0438 \u0432 \u0448\u0430\u0431\u043b\u043e\u043d\u0435 app.ini \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0437\u0430\u0434\u0430\u043b\u0438 \u043a\u0430\u043a \u00ab*\u00bb, \u0438\u0437-\u0437\u0430 \u0447\u0435\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440 \u0434\u043e\u0432\u0435\u0440\u044f\u043b \u0437\u0430\u043f\u0440\u043e\u0441\u0430\u043c \u0441 \u043b\u044e\u0431\u043e\u0433\u043e IP-\u0430\u0434\u0440\u0435\u0441\u0430.\n\n\u0415\u0441\u043b\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440 \u0432\u043a\u043b\u044e\u0447\u0430\u043b \u0432\u0445\u043e\u0434 \u0447\u0435\u0440\u0435\u0437 \u043e\u0431\u0440\u0430\u0442\u043d\u044b\u0439 \u043f\u0440\u043e\u043a\u0441\u0438, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0433 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0439 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043e\u043a X-WEBAUTH-USER \u0438 \u0432\u044b\u0434\u0430\u0442\u044c \u0441\u0435\u0431\u044f \u0437\u0430 \u043b\u044e\u0431\u043e\u0433\u043e \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0433\u043e \u0438\u043b\u0438 \u0443\u0433\u0430\u0434\u0430\u043d\u043d\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0431\u0435\u0437 \u043f\u0430\u0440\u043e\u043b\u044f \u0438 \u0442\u043e\u043a\u0435\u043d\u0430. \u041f\u0440\u0438 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u043e\u0439 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0446\u0438\u0438 \u0438\u043c\u044f \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0434\u0430\u0432\u0430\u043b\u043e \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u043f\u0440\u0430\u0432\u0430 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Sysdig, \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u043f\u0435\u0440\u0432\u044b\u0435 \u043f\u043e\u043f\u044b\u0442\u0430\u043b\u0438\u0441\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0447\u0435\u0440\u0435\u0437 13 \u0434\u043d\u0435\u0439 \u043f\u043e\u0441\u043b\u0435 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0433\u043e \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b, \u0430\u0442\u0430\u043a\u0430 \u0448\u043b\u0430 \u0441 IP-\u0430\u0434\u0440\u0435\u0441\u0430 \u0441\u0435\u0440\u0432\u0438\u0441\u0430 \u0430\u043d\u043e\u043d\u0438\u043c\u0438\u0437\u0430\u0446\u0438\u0438 \u0442\u0440\u0430\u0444\u0438\u043a\u0430. Gitea \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 1.26.3 \u0432 \u043a\u043e\u043d\u0446\u0435 \u0438\u044e\u043d\u044f, \u0443\u0431\u0440\u0430\u0432 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u0447\u043d\u044b\u0439 \u0441\u0438\u043c\u0432\u043e\u043b \u00ab*\u00bb \u0438 \u0441\u0434\u0435\u043b\u0430\u0432 \u0432\u0445\u043e\u0434 \u0447\u0435\u0440\u0435\u0437 \u043e\u0431\u0440\u0430\u0442\u043d\u044b\u0439 \u043f\u0440\u043e\u043a\u0441\u0438 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e\u0439 \u043e\u043f\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u0435\u0439.\n\n#gitea #\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c #docker #Sysdig\n\n@ZerodayAlert", "creation_timestamp": "2026-07-26T00:00:39.155708Z"}, {"uuid": "303030f9-2a82-48a5-b425-0049114bb819", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-20896", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/98223", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Exploit #CVE #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-20896-Gitea-Authentication-Bypass\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a judgedbykira\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-15 19:05:05\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nAn explanation and PoC to exploit CVE-2026-20896 Authentication Bypass Vulnerability on Gitea. Being able to steal session tokens for valid users in the Gitea instance.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-24T00:00:10.353529Z"}]}