Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure

**CVE-2026-20896 (CVSS 9.8)** in Gitea Docker images allowed unauthenticated attackers to impersonate any user via a trusted `X-WEBAUTH-USER` header because `REVERSE_PROXY_TRUSTED_PROXIES` was hard-coded to `*`; the issue was fixed in Gitea 1.26.3 but Sysdig observed initial exploitation attempts in the wild and about 6,200 internet-facing instances may be exposed, so immediate patching is advised.