CVE-2026-20896

Published Jul 3, 2026

Last updated a day ago

CVSS critical 9.8
Docker
Container Security

Overview

Description
Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled.
Source
88ee5874-cf24-4952-aea0-31affedb7ff2
NVD status
Deferred

Risk scores

CVSS 3.1

Type
Secondary
Base score
9.8
Impact score
5.9
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity
CRITICAL

Weaknesses

88ee5874-cf24-4952-aea0-31affedb7ff2
CWE-284

Social media

Hype score
Not currently trending

  1. It's Already When. — Field Note Active exploitation of max-severity ColdFusion (CVE-2026-48282), Langflow, and Gitea (CVE-2026-20896) flaws, plus GhostLock (CVE-2026-43499)... https://t.co/89LSZTiW9G #CyberSecurity #BlueTeam

    @itsalreadywhen

    8 Jul 2026

    5 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. 匿名の研究者がゼロデイ数件をGitHubリポジトリで公開（CVE-2026-55200、CVE-2026-20896） | Codebook｜Security News https://t.co/NGnxaYYb9X

    @fd0

    5 Jul 2026

    536 Impressions

    0 Retweets

    3 Likes

    2 Bookmarks

    0 Replies

    0 Quotes

  3. 匿名の研究者がゼロデイ数件をGitHubリポジトリで公開（CVE-2026-55200、CVE-2026-20896） https://t.co/OZreuEoWQc

    @crossbreed_dog

    4 Jul 2026

    38 Impressions

    0 Retweets

    1 Like

    1 Bookmark

    1 Reply

    0 Quotes

  4. 匿名の研究者がゼロデイ数件をGitHubリポジトリで公開（CVE-2026-55200、CVE-2026-20896） https://t.co/Bqw7agdx3U

    @ragemax

    1 Jul 2026

    423 Impressions

    1 Retweet

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  5. 匿名の研究者がゼロデイ数件をGitHubリポジトリで公開（CVE-2026-55200、CVE-2026-20896） | Codebook｜Security News https://t.co/1ICgrseNLp

    @ohhara_shiojiri

    30 Jun 2026

    80 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  6. ⚠️匿名の研究者がゼロデイ数件をGitHubリポジトリで公開（CVE-2026-55200、CVE-2026-20896） 〜サイバーアラート6月30日〜 https://t.co/QjIVS2Mp07

    @MachinaRecord

    30 Jun 2026

    204 Impressions

    0 Retweets

    2 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. CVE-2025-14269
  2. A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). Central does not limit the depth of GraphQL queries served on the authenticated GraphQL API. An authenticated user with a valid API token can send deeply nested queries that cause excessive resource consumption in Central, resulting in a denial of service for the management plane.•CVE-2026-9165
  3. containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI implementation improperly trusts Container Device Interface (CDI) annotations found within untrusted checkpoint image metadata during container restoration. When restoring a container from a checkpoint, containerd preserves CDI-related annotations from the checkpoint archive rather than relying solely on the pod's create-time specification. This allows a user with pod creation permissions to bypass standard Kubernetes resource allocation and device plugin enforcement, injecting arbitrary CDI edits (such as device nodes and host mounts) into the restored container. Successful exploitation requires that the node has CDI enabled and contains a matching host CDI specification for the requested device; environments where CDI is disabled or lacking sensitive device specifications are not affected. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9.•CVE-2026-53492
  4. containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a bug where the CRI plugin restores container.log from a checkpoint image without validating a symlinked path. This could result in reading an arbitrary file on the host via kubectl logs. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9.•CVE-2026-53489
  5. containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a vulnerability in the CRI checkpoint import process where it fails to validate the image references specified within a checkpoint image's configuration. An attacker with permissions to create pods can use a crafted checkpoint image to force containerd to pull a malicious image and assign it an arbitrary local tag, thereby poisoning the node's local image cache. Subsequently, if other pods on the same node attempt to use the poisoned tag with an IfNotPresent (or Never) pull policy, they will unknowingly execute the attacker's malicious image instead of the legitimate one. This can lead to a compromise of the affected pods, allowing the attacker to execute arbitrary code under the victim pod's identity. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9.•CVE-2026-50195

References

Sources include official advisories and independent security research.