Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=*

Gitea Docker image

Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled.

First seen: 23 Oct 2026
Last update: 23 Oct 2026, 23:17 UTC
Identifiers: CVE-2026-20896
CVSS: 9.8
Source: news
On the menu as: Docker images
CI servers

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=*
Severity: critical. Patch status: fix status unknown.
Affected: Gitea Docker image
Ids: CVE-2026-20896

Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled.

## Steps
1. Check Dockerfiles, compose files and Kubernetes or Helm manifests for affected images and tags. Report the tag in use and the first fixed tag.
2. This touches infrastructure (ci). Look in terraform, ansible, cloud-init, Dockerfiles and docs for the product and version we run. If it isn't in the repo, say so and list what a human should check on the box.
3. There is no fix yet. Until one ships: Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-20896") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://blog.gitea.com/release-of-1.26.3-and-1.26.4/ https://nvd.nist.gov/vuln/detail/CVE-2026-20896
https://pwned.coffee/i/gitea-docker-image-versions-up-to-and-including-1-26-2-u-cve-2026-20896

Timeline

23 Oct 2026, 23:17 UTC
Proof-of-concept code for CVE-2026-20896 is public on GitHub. Unverified, but expect scanning to follow.
23 Oct 2026
First reported.

Sources

Totalone very hot coffee