Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure

Threat actors are attempting to exploit a critical security flaw in Gitea Docker images, which was recently patched. The vulnerability, identified as CVE-2026-20896, has a high CVSS score of 9.8. It allows an unauthenticated internet client to gain elevated access due to the DevOps platform trusting the X-WEBAUTH-USER header from any source IP address. These exploitation attempts were observed just 13 days after the vulnerability was disclosed. Sysdig reported the attempts to exploit this flaw.