Gitea Docker Auth Bypass Patched, Yet Threat Actors Already Scanning 6,200 Deployments
Gitea patched a critical auth bypass (CVE‑2026‑20896) that let any IP spoof the X‑WEBAUTH‑USER header and assume any account, including admin. Within two weeks of disclosure, Sysdig observed threat actors probing roughly 6,200 internet‑facing instances, though no successful exploitation was seen yet. Operators must upgrade to 1.26.4 immediately.