[CVE-2026-20896]

July 9, 2026

• cve-2026-20896-gitea-poc — a checker for the Gitea Docker X-WEBAUTH-USER auth bypass now under active exploitation (6,200+ exposed instances); useful for validating your own exposure. GitHub · New Tools & Releases

in A 15-Year-Old Linux Kernel Bug Hands Root on Every Distro

July 8, 2026

• A critical Gitea authentication bypass, CVE-2026-20896, is being probed in the wild. Official Gitea Docker images up to 1.26.2 with reverse-proxy auth enabled trusted any source IP as a proxy, letting an attacker who reaches the container's HTTP port spoof X-WEBAUTH-USER and impersonate a known/guessable user — accessing repos and secrets. Fixed in 1.26.3/1.26.4; a public PoC/checker exists, and Sysdig observed first in-the-wild probing 13 days post-disclosure. SecurityWeek · Vulnerabilities & Exploits

in Synacktiv Drops a Kerberos Reflection Bypass That Hands Attackers SYSTEM

July 7, 2026

• Gitea Docker CVE-2026-20896 (CVSS 9.8) is being probed in the wild 13 days after disclosure. The flaw stems from Gitea trusting the X-WEBAUTH-USER header from any source IP, letting an unauthenticated internet client gain elevated access, per Sysdig (The Hacker News). · Vulnerabilities & Exploits

in A 16-Year-Old KVM Flaw Punches Through the Hypervisor Boundary