Gitea Docker Image (versions 1.26.2 and below)

The Docker image set REVERSE_PROXY_TRUSTED_PROXIES=*, meaning it accepted the X-WEBAUTH-USER header (a field that tells Gitea who the user is) from any source, not just from a trusted internal proxy. Think of it like a hotel front desk that accepts a note saying "I'm the hotel manager" from anyone who walks in off the street — with no ID check whatsoever.

An attacker sends a standard HTTP request to an exposed Gitea instance and includes a header naming any account — admin, gitea_admin, or any known username. Gitea processes the header as a verified identity and grants full access. No credentials, no tokens, one line of a request. Sysdig researchers confirmed active exploitation began at least 13 days before public disclosure.

Review access logs for requests containing X-WEBAUTH-USER headers arriving from external IP addresses. Look for unexpected admin account activity, particularly repository access, user creation, or settings changes. Check for authentication events with no corresponding password or token validation entries.

1. Upgrade to Gitea version 1.26.4 immediately (1.26.3 introduced a regression; 1.26.4 resolves both the CVE and that regression).
2. If upgrading is not immediately possible, set REVERSE_PROXY_TRUSTED_PROXIES to specific trusted IP addresses rather than the wildcard *.
3. Review access logs for suspicious activity to determine whether compromise has already occurred.