CVE-2026-20896: Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER`
The Gitea Docker images ship an app.ini template that hard-codes:
REVERSE_PROXY_TRUSTED_PROXIES = *
The documented default for this setting, in custom/conf/app.example.ini, is 127.0.0.0/8,::1/128, i.e. only loopback is trusted.
When an admin enables ENABLE_REVERSE_PROXY_AUTHENTICATION = true to put Gitea behind an authenticating reverse proxy and leaves the trusted-proxies setting at “the default”, they expect only the proxy’s loopback connection to inject identity. The Docker image instead trusts X-WEBAUTH-USER from any source IP that can reach the container.
References
- blog.gitea.com/release-of-1.26.3-and-1.26.4
- github.com/advisories/GHSA-f75j-4cw6-rmx4
- github.com/go-gitea/gitea/commit/99f8b3d9a1d32f4c39828e07971455a18191e0b9
- github.com/go-gitea/gitea/pull/38151
- github.com/go-gitea/gitea/releases/tag/v1.26.3
- github.com/go-gitea/gitea/security/advisories/GHSA-f75j-4cw6-rmx4
- nvd.nist.gov/vuln/detail/CVE-2026-20896
Code Behaviors & Features
Detect and mitigate CVE-2026-20896 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →