CVE-2026-20896

CRITICAL9.8Published on July 3, 2026

Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled.

Early warning: exploitation observed

Exploitation observed since Jul 6, 2026
Not yet in the official CISA catalogue
First attack observed 2 days after disclosure

Source: VulnCheck KEV · Jul 8, 2026 Jul 6, 2026

CVSS score9.8 / 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness type (CWE)CWE-284

Gitea sotto attacco: la RCE critica CVE-2026-60004 è nel catalogo KEV, oltre 8.300 server esposti

Vulnerabilities

Gitea under attack: critical RCE CVE-2026-60004 in KEV catalog, over 8,300 servers exposed

Critical RCE flaw CVE-2026-60004 in Gitea enables remote code execution. 8,300+ servers exposed. Patch to version 1.27.1 now.

Aug 29, 20264 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Early warning: exploitation observed

Related articles

Gitea under attack: critical RCE CVE-2026-60004 in KEV catalog, over 8,300 servers exposed