Gitea: Three Critical Security Vulnerabilities (CVE-2026-58426, -20896, -22874)
This text was generated using artificial intelligence (AI).Update July 6, 2026: In addition to CVE-2026-58426, two other critical vulnerabilities in Gitea have been disclosed. CVE-2026-20896 (CVSS 9.8) allows for complete account takeover without a password in Docker deployments with reverse proxy authentication enabled. CVE-2026-22874 (CVSS 9.6) allows authenticated users to perform server-side request forgery against internal network resources and cloud metadata endpoints. See below for details.
On the widely used, self-hosted Git platform Gitea Several critical security vulnerabilities were disclosed. The vulnerability CVE-2026-58426 with a CVSS score of 9.6 (Critical) affects the Gitea Actions feature and allows authenticated attackers with low privileges to bypass security boundaries between different projects in order to access sensitive build artifacts and manipulate their upload status. The second vulnerability CVE-2026-20896 with a CVSS score of 9.8 (Critical) affects Docker deployments and, under certain configuration conditions, allows an attacker to completely take over any user account. The third vulnerability CVE-2026-22874 with a CVSS score of 9.6 (Critical) Allows authenticated users with webhook or migration privileges to perform a non-blind server-side request forgery on internal network resources. Security updates to address all issues are available.
CVSS Scores: 9.6 (CVE-2026-58426), 9.8 (CVE-2026-20896), 9.6 (CVE-2026-22874), all Critical
Affected components: Gitea instances with Actions enabled (CVE-2026-58426); Gitea Docker images up to and including 1.26.2 with reverse proxy authentication enabled (CVE-2026-20896); Gitea 0.9.99 through 1.26.2 for users with webhook or migration permissions (CVE-2026-22874)
Impact: Unauthorized read access to build artifacts and write access to upload status across repository boundaries (CVE-2026-58426); complete account takeover without a password (CVE-2026-20896); access to internal network resources and cloud metadata, including IAM credentials (CVE-2026-22874)
Solution: Upgrade to Gitea Version 1.26.4 or the latest stable version (Note: Version 1.26.2 contains a known regression; Gitea recommends updating directly to 1.26.4).
Active Exploitation: There are reports of active exploitation of CVE-2026-20896.
Technical Analysis of CVE-2026-58426
The cause of the vulnerability lies in an ambiguity in the cryptographic verification of HMAC signatures used for signed URLs in the Gitea Actions Artifacts V4 API. An attacker who already has low-privileged access to the Gitea instance can send specially crafted requests to the API. Due to the faulty signature verification, the system incorrectly interprets these requests as legitimate.
The CVSS score CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N illustrates the potential threat:
AV:N (Network): The attack can be carried out remotely over the network.
AC:L (Low): Carrying out the attack does not require a high degree of complexity.
PR:L (Low): An attacker only needs an account with low privileges.
C:H (High Confidentiality) & I:H (High Integrity): The impact on data confidentiality and integrity is significant.
The fix was implemented in pull request #37707, which modifies the structure of the signature payload to ensure unique validation.
Technical Analysis of CVE-2026-20896
CVE-2026-20896 poses an even more serious threat because it does not require prior account access. The vulnerability affects only Gitea Docker deployments where reverse proxy authentication is enabled (ENABLE_REVERSE_PROXY_AUTHENTICATION=true). Binary distributions in the default configuration are not affected.
The official Gitea Docker image sets the configuration option REVERSE_PROXY_TRUSTED_PROXIES by default, to the wildcard value *. This means that Gitea uses HTTP headers such as X-WEBAUTH-USER accepted as trustworthy by any source. An attacker can send an HTTP request with a forged X-WEBAUTH-USER-Send a header set to any username—including administrator accounts. Gitea then authenticates the attacker as that user without verifying the password.
The CVSS score CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H emphasizes the critical nature of:
AV:N (Network): Remote attack possible.
AC:L (Low): No special requirements are necessary.
PR:N (None): No authentication required.
UI:N (None): No user interaction is required.
C:H/I:H/A:H: Confidentiality, integrity, and availability could be completely compromised.
Exploitation of this vulnerability could lead to a complete takeover of the Gitea instance, including access to all repositories, secrets, build artifacts, and administrative functions. According to the security advisory, there are indications that this vulnerability is being actively exploited, underscoring the urgency of an immediate update.
Technical Analysis of CVE-2026-22874
CVE-2026-22874 describes a non-blind server-side request forgery (SSRF) vulnerability caused by insufficient IP validation in the function HostMatchList.checkIP is caused by. The vulnerability affects Gitea versions 0.9.99 through 1.26.2 and can be exploited by authenticated users with webhook or repository migration permissions.
The flawed implementation allows attackers to trick Gitea into sending HTTP requests to reserved internal address ranges that should actually be blocked. Specifically affected are:
The RFC 6598 address range 100.64.0.0/10 (Carrier-Grade NAT)
The cloud metadata endpoint 169.254.169.254, which is used in AWS, Azure, and other cloud environments to provide IAM credentials and instance metadata
The CVSS score CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N shows the severity of the vulnerability:
AV:N (Network): Remote attack possible.
AC:L (Low): No high level of complexity is required.
PR:L (Low): Authentication with low-level permissions is sufficient.
S:C (Changed Scope): The impact extends beyond the vulnerable component.
C:H (High Confidentiality) & I:H (High Integrity): Significant impact on confidentiality and integrity.
Since the webhook history in Gitea displays the full HTTP response, this is a non-blind SSRF. An attacker can directly read the responses from internal services. In cloud environments, this allows access to IAM credentials, temporary security tokens, and other sensitive metadata that can be used to further compromise the cloud infrastructure.
Business Risks Posed by Compromised CI/CD Pipelines
These vulnerabilities pose a significant risk to companies that use a central Gitea instance for multiple development teams or projects. Build artifacts are a key component of CI/CD processes and often contain sensitive information such as:
Compiled application binaries and libraries
Configuration files containing login credentials for databases or cloud services
Private API Keys and Tokens
Intellectual property in the form of source code or proprietary assets
By taking advantage of CVE-2026-58426 An attacker with access to a non-critical repository can bypass logical isolation and gain access to artifacts from highly secure production pipelines. CVE-2026-20896 It also allows for complete takeover of the platform without prior account access, which can lead to the theft of trade secrets, the compromise of production environments, or the manipulation of the software supply chain. Reports of active exploitation of this vulnerability significantly increase the risk. CVE-2026-22874 expands the attack surface of the cloud infrastructure: In cloud deployments, an attacker can exploit the SSRF vulnerability to extract IAM credentials from the metadata endpoint and thereby gain access to S3 buckets, databases, or other cloud resources.
CVE-2026-58426, CVE-2026-20896 and CVE-2026-22874 are not the first critical security findings in Gitea: As recently as May 2026, CVE-2026-27771 (CVSS 8.2), a vulnerability was patched that allowed unauthenticated attackers to retrieve private container images from an estimated 30,000+ affected deployments worldwide. The accumulation of critical vulnerabilities underscores the need for systematic vendor risk management. (Source: SecurityWeek, TheHackerNews, May 2026 — https://www.securityweek.com/gitea-vulnerability-exposed-30000-deployments-to-attacks/)
According to security researchers, Germany is among the countries with the highest density of exposed Gitea instances. Organizations subject to NIS-2 or the GDPR should classify compromised build artifacts, account takeovers, access to cloud metadata, or the circumvention of branch protection mechanisms as potential data breaches and, if necessary, consider filing a report in accordance with GDPR Article 33 within 72 hours. Operators of critical infrastructure are also subject to the reporting obligations under the BSI Act.
Recommended countermeasures
Administrators of Gitea instances should take immediate action to secure their systems.
Immediate action:
Upgrade to Gitea Version 1.26.4 or the latest stable version. The original security patch for CVE-2026-58426 was released on May 20, 2026, in version 1.26.2; however, since 1.26.2 contains a known regression, Gitea recommends updating directly to 1.26.4. Version 1.26.4 fixes CVE-2026-58426, CVE-2026-20896, and CVE-2026-22874. The fix for CVE-2026-20896 was already released in version 1.26.3 (the wildcard default was removed, and reverse proxy authentication is now opt-in). The fix for CVE-2026-22874 was also initially released in version 1.26.3, but it contained a regression that was corrected in 1.26.4.
For Docker deployments: Check whether reverse proxy authentication is enabled (ENABLE_REVERSE_PROXY_AUTHENTICATION=true). If so, an immediate update is absolutely necessary. Alternatively, you can disable the feature until the update is installed. Given the reports of active exploitation of CVE-2026-20896, this check should be given the highest priority.
For cloud deployments: Check whether there are any users with webhook or migration permissions who are not fully trusted. Check webhook histories and cloud access logs for suspicious activity, particularly access to the metadata endpoint 169.254.169.254.
Long-Term Strategy:
Set up continuous vulnerability monitoring for your entire IT infrastructure so you can be notified promptly of new security vulnerabilities.
Implement a vendor risk management system to systematically assess and monitor the security of third-party products in use.
Visibility and Control with LocateRisk
Self-hosted systems such as Gitea are an important part of the development infrastructure, but without continuous monitoring, they can become an uncontrolled risk. Given the growing number of critical vulnerabilities in widely used open-source platforms, the systematic identification and continuous assessment of such systems is crucial.
The LocateRisk platform supports companies in this regard on two levels:
External Attack Surface Management (EASM): Our solution continuously identifies all publicly accessible systems in your organization, including self-hosted Gitea instances, forgotten subdomains, and unmanaged cloud assets. This gives you visibility into your actual attack surface, allows you to identify exposed or outdated Gitea servers, and enables you to check their version status against known vulnerabilities such as CVE-2026-58426, CVE-2026-20896, and CVE-2026-22874—even if these systems are not centrally inventoried.
Continuous Vendor Risk Management (C-VRM): If you use development or repository services from external providers, your security also depends on their patching practices. The recurring vulnerabilities in Gitea illustrate why a one-time assessment is not enough: LocateRisk continuously evaluates the security level of your service providers and software vendors and proactively alerts you to new risks in your supply chain.
As a German provider offering hosting in ISO 27001-certified data centers in Germany, LocateRisk helps companies comply with GDPR requirements and reduces the risk of data access by U.S. authorities.
Continuous monitoring of your external IT systems is the foundation of a resilient security strategy. LocateRisk identifies and assesses security risks in your attack surface before they can be exploited.
CVE-2026-58426 refers to a critical vulnerability (CVSS 9.6) in the Gitea Actions Artifacts V4 API. The vulnerability stems from an ambiguity in the HMAC signature verification of signed URLs, which allows a low-privileged attacker to access build artifacts from other projects across repository boundaries and manipulate their upload status. The associated security advisory is listed under the identifier GHSA-hg5r-vq93-9fv6.
CVE-2026-20896 is a critical vulnerability (CVSS 9.8) in Gitea Docker images that allows a complete account takeover without a password when reverse proxy authentication is enabled. Unlike CVE-2026-58426, an attacker does not need prior account access in this case. The vulnerability arises from the default wildcard configuration of REVERSE_PROXY_TRUSTED_PROXIES in the Docker image, which allows for fake X-WEBAUTH-USER-Headers are accepted. The advisory is listed under GHSA-f75j-4cw6-rmx4. There are reports of active exploitation of this vulnerability.
CVE-2026-22874 is a critical non-blind server-side request forgery (SSRF) vulnerability (CVSS 9.6) in Gitea versions 0.9.99 through 1.26.2. It allows authenticated users with webhook or migration privileges to send HTTP requests to internal network resources, including the cloud metadata endpoint 169.254.169.254. Since the webhook history displays the full HTTP response, attackers can extract IAM credentials, temporary security tokens, and other sensitive metadata. The advisory is listed under GHSA-2r5c-gw76-rh3w.
Gitea instances with the Actions feature enabled are affected by CVE-2026-58426. CVE-2026-20896 affects only Docker deployments up to and including version 1.26.2 with reverse proxy authentication enabled (ENABLE_REVERSE_PROXY_AUTHENTICATION=true) are affected. Binary distributions in their default configuration are not affected by CVE-2026-20896. CVE-2026-22874 affects all Gitea versions from 0.9.99 through 1.26.2, inclusive. The fixes for CVE-2026-58426, CVE-2026-20896, and CVE-2026-22874 are included in version 1.26.4. Since version 1.26.2 contains a known regression and version 1.26.3 has a regression in the fix for CVE-2026-22874, Gitea recommends updating directly to Version 1.26.4 or the latest stable version of the 1.26.x branch.
According to Security Advisory GHSA-f75j-4cw6-rmx4, there are indications of active exploitation of CVE-2026-20896. This underscores the urgency of an immediate update, especially for Docker deployments with reverse proxy authentication enabled. For CVE-2026-58426 and CVE-2026-22874, there are no confirmed reports of active exploitation in the wild as of the time of disclosure. However, due to the low attack complexity and high severity of all vulnerabilities, the updates should still be applied immediately.
CVE Quick Check
In just a few minutes, check whether there are any indications of a current CVE on your externally visible attack surface.
A rough estimate in just a few minutes via email.
Learn more during a free consultation with a LocateRisk consultant.
You'll receive this by email
companyYour Company, LLC
Verified CVECVE-2024-3094
Passive Assessment
Information About the CVENotes found
Want to find out more, book a demo or simply exchange ideas? We look forward to hearing from you!
We use cookies to optimize our website and our service.
Functional
Always active
Technical storage or access is strictly necessary for the lawful purpose of enabling the use of a particular service expressly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a message over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that have not been requested by the subscriber or user.
Statistics
The technical storage or access, which is carried out exclusively for statistical purposes.Technical storage or access used solely for anonymous statistical purposes. Without a subpoena, the voluntary consent of your Internet service provider, or additional records from third parties, information stored or accessed for this purpose alone generally cannot be used to identify you.
Marketing
Technical storage or access is necessary to create user profiles, to send advertisements, or to track the user on a website or across multiple websites for similar marketing purposes.
English 
Deutsch 
Français