Attackers have started probing a critical flaw in Gitea's official Docker images, the self-hosted Git service used by many development teams. The images shipped a configuration that trusted the X-WEBAUTH-USER header from any source address, so with reverse-proxy login enabled, anyone who could reach the port could send that header and be authenticated as any user, no password required. Tracked as CVE-2026-20896 and rated 9.8, it was fixed in version 1.26.3 late last month, which removes the wildcard and makes reverse-proxy authentication opt-in. Sysdig reported the first exploitation attempt 13 days after disclosure, so far just reconnaissance, against some of the roughly 6,200 internet-facing Gitea instances.
Researchers disclosed CVE-2026-3854, a critical GitHub Enterprise Server flaw that lets anyone with push access execute arbitrary commands on the GitHub server with a single git push. The bug is in how Enterprise Server handles repository hooks during push operations - a crafted commit message or filename bypasses the sanitization that normally prevents shell injection. GitHub patched it last week, but self-hosted instances need to apply the patch manually, and telemetry shows most haven't yet. Anyone with developer-level access to a vulnerable Enterprise Server can take over the entire instance, then pivot into every repository and CI/CD secret it hosts.
TrustStrike Labs