Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-20896.

Upgrade to Pro
CVE-2026-20896 CrowdStrike LogScale · LogScale

Detect Gitea Docker REVERSE_PROXY_TRUSTED_PROXIES Wildcard Allows X-WEBAUTH-USER Auth Bypass (CVE-2026-20896) in CrowdStrike LogScale

The official Gitea Docker image ships with REVERSE_PROXY_TRUSTED_PROXIES set to * by default. Because Gitea's reverse-proxy authentication feature trusts the X-WEBAUTH-USER header from any source claiming to be a trusted proxy, an unauthenticated attacker with direct network access to the Gitea HTTP listener (bypassing any intended reverse proxy) can set this header to impersonate any username, including admin accounts, and obtain a fully authenticated session without credentials. Affects code.gitea.io/gitea < 1.26.3. This detection identifies HTTP requests to Gitea that carry X-WEBAUTH-USER (or similar reverse-proxy auth headers) originating from IP addresses outside the expected reverse-proxy/load-balancer CIDR, as well as anomalous successful authentications tied to reverse-proxy auth with no corresponding upstream proxy log entry.

MITRE ATT&CK

Tactic
Initial Access Privilege Escalation Defense Evasion

LogScale Detection Query

CrowdStrike LogScale (LogScale)
cql 
#event_simpleName=HttpRequest AND event_platform=SaaS
| RequestHeaders=/x-webauth-user/i
| in(field=SourceIP, values=["10.0.0.0/8","172.16.0.0/12","192.168.0.0/16"], mode=cidr, negate=true)
| table([@timestamp, SourceIP, RequestHeaders, RequestURI])
critical severity medium confidence

Detects HTTP requests to Gitea carrying the X-WEBAUTH-USER header originating from source IPs outside trusted internal proxy CIDR ranges.

Data Sources

CrowdStrike Falcon network/HTTP telemetryReverse proxy application logs forwarded to Falcon LogScale

Required Tables

HttpRequest

False Positives & Tuning

  • New proxy IP not yet added to trusted CIDR baseline
  • NAT/load balancer obfuscating true source IP of the legitimate proxy
  • Scanner or QA tooling replaying proxy headers from an allowed but reclassified subnet

Other platforms for CVE-2026-20896

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Direct X-WEBAUTH-USER header injection against Gitea container

    Expected signal: HTTP request log entry on the Gitea/reverse-proxy access log showing X-WEBAUTH-USER header with source IP of the test host

  2. Test 2Verify REVERSE_PROXY_TRUSTED_PROXIES wildcard misconfiguration

    Expected signal: Command execution logged in container audit/history; no network telemetry generated

  3. Test 3Impersonate arbitrary user and attempt privileged API call

    Expected signal: Gitea audit log entry for an admin API call sourced from an impersonated session; access log entry with X-WEBAUTH-USER header from untrusted source IP

Last updated: 2026-07-25 Research depth: standard
References (6)

Unlock playbooks & atomic tests with Pro

Get the full detection package for CVE-2026-20896 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.

df00tech Pro — £29/user/month

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance
Sign Up for Pro View Pricing

Related Detections

Tactic Hubs

TA0001Initial AccessTA0004Privilege EscalationTA0005Defense Evasion

Related Techniques

T1078Valid AccountsT1190Exploit Public-Facing Application

Same Tactic: Initial Access

Popular Detections