cybercrime.clubhttps://cybercrime.club/tags/misconfiguration/Infrastructure security news for people who build infrastructure.Hugo -- gohugo.ioen-usTue, 07 Jul 2026 11:07:00 -0400Gitea CVE-2026-20896: Docker Images Trusted a Spoofable Header for Admin Access, Now Under Active Probinghttps://cybercrime.club/posts/gitea-cve-2026-20896-docker-trusted-proxy-header-auth-bypass/Tue, 07 Jul 2026 11:07:00 -0400https://cybercrime.club/posts/gitea-cve-2026-20896-docker-trusted-proxy-header-auth-bypass/Gitea's official Docker images shipped with reverse-proxy header trust wide open by default, letting anyone who can reach the port impersonate any user including an admin — Sysdig has now caught the first in-the-wild probing, 13 days after disclosure.vulnerabilities