CVE-2026-20896: Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER`
The Gitea Docker images ship an app.ini template that hard-codes:
REVERSE_PROXY_TRUSTED_PROXIES = *
The documented default for this setting, in custom/conf/app.example.ini, is 127.0.0.0/8,::1/128, i.e. only loopback is trusted.
When an admin enables ENABLE_REVERSE_PROXY_AUTHENTICATION = true to put Gitea behind an authenticating reverse proxy and leaves the trusted-proxies setting at “the default”, they expect only the proxy’s loopback connection to inject identity. The Docker image instead trusts X-WEBAUTH-USER from any source IP that can reach the container.
References
- blog.gitea.com/release-of-1.26.3-and-1.26.4
- github.com/advisories/GHSA-f75j-4cw6-rmx4
- github.com/go-gitea/gitea/commit/99f8b3d9a1d32f4c39828e07971455a18191e0b9
- github.com/go-gitea/gitea/pull/38151
- github.com/go-gitea/gitea/releases/tag/v1.26.3
- github.com/go-gitea/gitea/security/advisories/GHSA-f75j-4cw6-rmx4
- nvd.nist.gov/vuln/detail/CVE-2026-20896
Code Behaviors & Features
Detect and mitigate CVE-2026-20896 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →