Gitea Docker Flaw Now Actively Probed: One Header Grants Admin Access…

A critical authentication bypass in Gitea's official Docker image allows unauthenticated remote admin access via a single HTTP header due to misconfigured reverse-proxy trust defaults. Automated scanners began probing the flaw 13 days after disclosure; unpatched instances face immediate risk of code injection and supply-chain compromise. If you run Gitea in Docker without 1.26.4, attackers need no credentials to seize your repos and inject malicious code into every build downstream. That header misconfiguration is live scanning right now—patch this week or air-gap the instance.