CVE-2026-20896 Exploit Metadata

PoC files

4 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Analysisdeepseek-v4-pro:cloud · 2026-08-06

Technical assessment

The artifact is a proof-of-concept exploit for CVE-2026-20896. It includes a Dockerfile that sets up a vulnerable Gitea instance and a Python script (poc.py) that sends an HTTP request with a forged X-WEBAUTH-USER header to bypass authentication and access a private repository, confirming the vulnerability.

Backdoor review

No backdoor observed in reviewed code

The repository contains a proof-of-concept for CVE-2026-20896, a Gitea authentication bypass. The Dockerfile sets up a vulnerable Gitea instance and creates a private proof repository. The Python script (poc.py) sends HTTP requests with a forged X-WEBAUTH-USER header to demonstrate the bypass. All code is plaintext and directly related to demonstrating the stated vulnerability. No concealed executable behavior, persistence, credential exfiltration, or unrelated payloads were observed.

ClassificationExploit

Model confidence98%

AuthenticationNot required

LanguagesDockerfileMarkdownPython

Target softwareGitea

Attack typesauthentication bypassprivilege escalation

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains code that actively exploits the vulnerability by sending a crafted request to bypass authentication and access a protected resource. The Python script (poc.py) is designed to exercise the vulnerability, not merely detect it, and the README describes it as a 'PoC' that demonstrates the bypass.

README.md:1README.md:40-42poc.py:1-5poc.py:68-94

Requirements

A running Gitea instance with reverse-proxy authentication enabled and REVERSE_PROXY_TRUSTED_PROXIES set to '*'.README.md:10
The attacker must be able to reach the Gitea backend directly or through a proxy that preserves the X-WEBAUTH-USER header.README.md:22

Observed behavior

The Dockerfile builds a Gitea 1.26.2 image with reverse-proxy authentication enabled and creates an admin user and a private repository containing a proof file.Dockerfile:3-9Dockerfile:26-32
The Python script sends an HTTP GET request to the private proof file with the header 'X-WEBAUTH-USER: gitea-admin' and checks if the response status is 200 and the body matches the expected proof string.poc.py:29-32poc.py:72-74poc.py:84-89
If the bypass is successful, the script prints 'VULNERABLE' and the proof string, demonstrating unauthorized access to the private repository.poc.py:91-94

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Url: http://127.0.0.1:3000Target URL used by the PoC to interact with the local Gitea instance.poc.py:56
Http Header: X-WEBAUTH-USERThe header used to demonstrate the authentication bypass.poc.py:32
String: CVE-2026-20896_AUTH_BYPASS_CONFIRMEDExpected proof string stored in the private repository to confirm successful exploitation.poc.py:20

Review boundaries

What the analysis did not establish

One file (total 4) is omitted from the packet; its content is not provided, but the packet reports it as a text file without content. The analysis is based on the three provided files.
One file (metadata only) was omitted from text analysis; its content was not reviewed.
Binary content was not analyzed; the review is limited to the supplied text evidence.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

GitHub

Repository root

Created 2026-07-29Vuln labCVE-2026-20896Dockerfile

1 Dockerfile

Analysisdeepseek-v4-pro:cloud · 2026-08-06

Environment assessment

A single-container Docker lab based on gitea/gitea:1.26.2 that enables reverse-proxy authentication, creates an admin user and a private proof repository at startup, and provides a PoC script to demonstrate CVE-2026-20896 authentication bypass via the X-WEBAUTH-USER header.

Dockerfile:1-39README.md:1-77poc.py:1-103

Lab assessment

Vulnerability lab

The README explicitly describes the environment as a PoC for CVE-2026-20896, the Dockerfile configures the vulnerable reverse-proxy authentication and creates a private proof repository, and the included poc.py script automates confirmation of the bypass.

README.md:1-3Dockerfile:1-39poc.py:1-4

Lab shapeDockerfile

ServicesUnknown

Compose manifests0

Dockerfiles1

Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries

Components

Services and files described by the evidence

gitea/gitea:1.26.2 base image

vulnerable target application

Official Gitea Docker image version 1.26.2, which is the vulnerable version according to the README. It is configured via environment variables to use SQLite3, lock installation, disable registration, and enable reverse-proxy authentication.

Dockerfile:3-9README.md:17-19

poc-entrypoint script

lab initializerproof creator

A shell script embedded in the Dockerfile that starts Gitea, waits for it to become healthy, creates an admin user (gitea-admin) and a non-admin user (student01) with random passwords, generates an access token, creates a private repository (private-proof), and commits a file containing the proof string CVE-2026-20896_AUTH_BYPASS_CONFIRMED. It then waits for the Gitea process.

Dockerfile:11-37

poc.py

exploit verification script

A Python script that sends three HTTP requests to the target Gitea instance: one without an identity header, one with X-WEBAUTH-USER: student01, and one with X-WEBAUTH-USER: gitea-admin. It checks that only the gitea-admin request returns HTTP 200 and the expected proof string, printing VULNERABLE if the bypass is confirmed.

poc.py:1-103

CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-20896

Supported by supplied evidence

The lab explicitly targets CVE-2026-20896. The Dockerfile enables reverse-proxy authentication (ENABLE_REVERSE_PROXY_AUTHENTICATION=true) and the PoC script demonstrates that an unauthenticated request with X-WEBAUTH-USER: gitea-admin can access a private repository, consistent with the described authentication bypass.

Dockerfile:8poc.py:14-16poc.py:72-82

Exercise context

Requirements and sequence described by the evidence

Prerequisites

Docker must be installed to build and run the image.README.md:25-29
The Gitea backend must be directly reachable on port 3000 (mapped to host 127.0.0.1:3000).README.md:28README.md:37
Python 3.10 or later is required to run poc.py.README.md:43

Evidence-described exercise path

Build the Docker image: docker build -t cve-2026-20896-gitea-vuln .README.md:26
Run the container: docker run -d --rm --name cve-2026-20896-gitea-vuln -p 127.0.0.1:3000:3000 cve-2026-20896-gitea-vulnREADME.md:28
Wait a few seconds for Gitea and the private proof repository to initialize.README.md:30
Execute the cURL PoC: curl -s -L -H "X-WEBAUTH-USER: gitea-admin" http://127.0.0.1:3000/gitea-admin/private-proof/raw/branch/main/proof.txtREADME.md:35-37
Alternatively, run the Python PoC: python poc.py http://127.0.0.1:3000README.md:41-43
Verify the output shows VULNERABLE and the proof string CVE-2026-20896_AUTH_BYPASS_CONFIRMED.README.md:37poc.py:82-84
Clean up: docker stop cve-2026-20896-gitea-vulnREADME.md:63

Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is confined to the lab container and directed at the intended vulnerable target. The Dockerfile only configures Gitea, creates test users and a proof repository, and exposes port 3000 on localhost. The PoC script only makes HTTP requests to the specified target. No host escape, persistence, credential theft, external connections, or destructive actions are observed.

Dockerfile:1-39poc.py:1-103README.md:25-63

Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

CVE-2026-20896