Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-20896.
Upgrade to ProDetect Gitea Docker REVERSE_PROXY_TRUSTED_PROXIES Wildcard Allows X-WEBAUTH-USER Auth Bypass (CVE-2026-20896) in Microsoft Sentinel
The official Gitea Docker image ships with REVERSE_PROXY_TRUSTED_PROXIES set to * by default. Because Gitea's reverse-proxy authentication feature trusts the X-WEBAUTH-USER header from any source claiming to be a trusted proxy, an unauthenticated attacker with direct network access to the Gitea HTTP listener (bypassing any intended reverse proxy) can set this header to impersonate any username, including admin accounts, and obtain a fully authenticated session without credentials. Affects code.gitea.io/gitea < 1.26.3. This detection identifies HTTP requests to Gitea that carry X-WEBAUTH-USER (or similar reverse-proxy auth headers) originating from IP addresses outside the expected reverse-proxy/load-balancer CIDR, as well as anomalous successful authentications tied to reverse-proxy auth with no corresponding upstream proxy log entry.
MITRE ATT&CK
KQL Detection Query
let TrustedProxyCIDRs = dynamic(["10.0.0.0/8","172.16.0.0/12","192.168.0.0/16"]);
W3CIISLog
| where cs_uri_stem has "/user/login" or csUriQuery has "X-WEBAUTH-USER" or cs(X-WEBAUTH-USER) != ""
| extend WebAuthUser = cs(X-WEBAUTH-USER)
| where isnotempty(WebAuthUser)
| where not(ipv4_is_match(c_ip, "10.0.0.0/8") or ipv4_is_match(c_ip, "172.16.0.0/12") or ipv4_is_match(c_ip, "192.168.0.0/16"))
| project TimeGenerated, c_ip, WebAuthUser, cs_uri_stem, cs_User_Agent
| order by TimeGenerated descDetects requests to Gitea containing the X-WEBAUTH-USER reverse-proxy auth header originating from source IPs outside the trusted internal proxy CIDR ranges, indicating direct-to-application header injection auth bypass.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate reverse proxy rotated to a new untracked IP not yet added to the trusted CIDR list
- Internal load balancer health checks that pass through unexpected source IP due to NAT
- Misconfigured monitoring tool forwarding synthetic X-WEBAUTH-USER test headers
Other platforms for CVE-2026-20896
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Direct X-WEBAUTH-USER header injection against Gitea container
Expected signal: HTTP request log entry on the Gitea/reverse-proxy access log showing X-WEBAUTH-USER header with source IP of the test host
- Test 2Verify REVERSE_PROXY_TRUSTED_PROXIES wildcard misconfiguration
Expected signal: Command execution logged in container audit/history; no network telemetry generated
- Test 3Impersonate arbitrary user and attempt privileged API call
Expected signal: Gitea audit log entry for an admin API call sourced from an impersonated session; access log entry with X-WEBAUTH-USER header from untrusted source IP
References (6)
- https://github.com/go-gitea/gitea/security/advisories/GHSA-f75j-4cw6-rmx4
- https://nvd.nist.gov/vuln/detail/CVE-2026-20896
- https://github.com/go-gitea/gitea/pull/38151
- https://github.com/go-gitea/gitea/commit/99f8b3d9a1d32f4c39828e07971455a18191e0b9
- https://blog.gitea.com/release-of-1.26.3-and-1.26.4
- https://github.com/go-gitea/gitea/releases/tag/v1.26.3
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-20896 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month