Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure

Threat actors are actively probing a critical security vulnerability in Gitea Docker images, identified as CVE-2026-20896 with a CVSS score of 9.9, just 13 days after its disclosure. The flaw, which affects Gitea versions prior to 1.22.0, allows remote code execution via crafted Docker images. Sysdig researchers reported observing exploitation attempts in the wild, targeting unpatched instances. Gitea, a popular open-source self-hosted Git service, released a patch on February 28, 2026. Organizations using Gitea in Docker containers are urged to update immediately to prevent potential breaches. The vulnerability underscores the ongoing risk of rapid weaponization of disclosed flaws in widely used DevOps tools.

Global Impact

This vulnerability primarily impacts the DevOps and software development ecosystem, where Gitea is used for source code management. Successful exploitation could lead to supply chain attacks, as compromised Gitea instances may allow attackers to inject malicious code into repositories.