Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-20896.

Upgrade to Pro
CVE-2026-20896 Splunk · SPL

Detect Gitea Docker REVERSE_PROXY_TRUSTED_PROXIES Wildcard Allows X-WEBAUTH-USER Auth Bypass (CVE-2026-20896) in Splunk

The official Gitea Docker image ships with REVERSE_PROXY_TRUSTED_PROXIES set to * by default. Because Gitea's reverse-proxy authentication feature trusts the X-WEBAUTH-USER header from any source claiming to be a trusted proxy, an unauthenticated attacker with direct network access to the Gitea HTTP listener (bypassing any intended reverse proxy) can set this header to impersonate any username, including admin accounts, and obtain a fully authenticated session without credentials. Affects code.gitea.io/gitea < 1.26.3. This detection identifies HTTP requests to Gitea that carry X-WEBAUTH-USER (or similar reverse-proxy auth headers) originating from IP addresses outside the expected reverse-proxy/load-balancer CIDR, as well as anomalous successful authentications tied to reverse-proxy auth with no corresponding upstream proxy log entry.

MITRE ATT&CK

Tactic
Initial Access Privilege Escalation Defense Evasion

SPL Detection Query

Splunk (SPL)
spl 
index=web sourcetype=gitea:access ("X-WEBAUTH-USER" OR "X-Webauth-User")
| rex field=_raw "X-WEBAUTH-USER:\s*(?<webauth_user>\S+)"
| where isnotnull(webauth_user)
| eval trusted=if(cidrmatch("10.0.0.0/8",src_ip) OR cidrmatch("172.16.0.0/12",src_ip) OR cidrmatch("192.168.0.0/16",src_ip),"yes","no")
| search trusted=no
| table _time, src_ip, webauth_user, uri_path, http_user_agent
| sort -_time
critical severity medium confidence

Flags Gitea HTTP requests bearing an X-WEBAUTH-USER header from source IPs outside trusted internal reverse-proxy ranges, consistent with direct exploitation of the wildcard REVERSE_PROXY_TRUSTED_PROXIES default.

Data Sources

Gitea/nginx access logsDocker container stdout logs shipped to Splunk

Required Sourcetypes

gitea:accessnginx:access

False Positives & Tuning

  • New proxy or CDN edge node IP not yet whitelisted in the CIDR check
  • Blue/green deployment temporarily routing through an untracked internal host
  • Load testing tools replaying captured proxy headers from a non-proxy host

Other platforms for CVE-2026-20896

Microsoft Sentinel (KQL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Direct X-WEBAUTH-USER header injection against Gitea container

    Expected signal: HTTP request log entry on the Gitea/reverse-proxy access log showing X-WEBAUTH-USER header with source IP of the test host

  2. Test 2Verify REVERSE_PROXY_TRUSTED_PROXIES wildcard misconfiguration

    Expected signal: Command execution logged in container audit/history; no network telemetry generated

  3. Test 3Impersonate arbitrary user and attempt privileged API call

    Expected signal: Gitea audit log entry for an admin API call sourced from an impersonated session; access log entry with X-WEBAUTH-USER header from untrusted source IP

Last updated: 2026-07-25 Research depth: standard
References (6)

Unlock playbooks & atomic tests with Pro

Get the full detection package for CVE-2026-20896 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.

df00tech Pro — £29/user/month

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance
Sign Up for Pro View Pricing

Related Detections

Tactic Hubs

TA0001Initial AccessTA0004Privilege EscalationTA0005Defense Evasion

Related Techniques

T1078Valid AccountsT1190Exploit Public-Facing Application

Same Tactic: Initial Access

Popular Detections