Critical Gitea CVE-2022-38779 exposes private container images

Key Takeaways

• A critical vulnerability, CVE-2026-27771, affects Gitea’s built-in container registry.
• Unauthenticated attackers can download private container images without requiring credentials.
• All Gitea versions prior to 1.26.2 and the Forgejo fork are exposed.
• The flaw has a CVSS score of 9.8 (Critical) and impacts over 31,000 internet-facing instances.
• A patch is available in Gitea version 1.26.2, and immediate upgrade is strongly recommended.

Critical Gitea Flaw Exposes Private Container Images to Unauthenticated Attackers

A severe security vulnerability in Gitea’s integrated container registry is allowing unauthorized individuals to access and download private container images without any authentication. This critical flaw, tracked as CVE-2026-27771, poses substantial risks for organizations leveraging Gitea in their self-hosted Git and CI/CD pipelines.

The core of the issue lies in a failure of Gitea’s access control mechanisms within its container registry component. Despite repositories being configured for private access, the registry endpoint fails to properly validate user authentication before serving image manifests and layers.

This oversight enables remote attackers to initiate standard Docker or OCI pull requests against the vulnerable registry API. By doing so, they can anonymously retrieve complete container images, effectively bypassing all intended access restrictions and exposing sensitive data potentially embedded within these images.

Profound Security Implications

The ramifications of this vulnerability are extensive. Container images frequently encapsulate proprietary application source code, internal system configurations, API keys, database credentials, and cloud access tokens. Unauthorized access to such critical data can furnish attackers with the necessary intelligence to map internal infrastructure, escalate privileges within networks, and ultimately compromise production environments.

In the most severe scenarios, this exposure could facilitate lateral movement across an organization’s systems, lead to significant data breaches, or even result in a complete takeover of critical infrastructure.

Widespread Exposure Across Gitea Ecosystem

All Gitea versions released before 1.26.2 are susceptible to this vulnerability. Furthermore, Forgejo, a popular fork of Gitea that shares the identical container registry implementation, has also been independently confirmed to be vulnerable.

Given Gitea’s extensive adoption across various development pipelines globally, the potential exposure is considerable. Researchers estimate that more than 31,000 internet-facing Gitea instances are at risk. These deployments span diverse sectors, including healthcare, aerospace, retail, and enterprise software. A significant portion of these instances are hosted on major cloud platforms, further amplifying the overall risk surface.

The vulnerability was initially discovered in April 2026 by NoScope, an autonomous penetration testing agent, which then responsibly disclosed the flaw to the Gitea maintainers. Remarkably, this issue had remained undetected for nearly four years since the container registry feature was first introduced.

While no public exploit code or active exploitation has been observed to date, Orca Security researchers have emphasized the high-risk nature of this flaw due to its ease of exploitation and the complete absence of authentication requirements.

Gitea has since released a fix for this vulnerability in version 1.26.2. Users are strongly urged to upgrade their Gitea instances immediately to mitigate the risk.

What You Should Do

• Upgrade Immediately: Update all Gitea instances to version 1.26.2 or newer without delay.
• Apply Temporary Mitigation: If immediate upgrade is not feasible, enable the REQUIRE_SIGNIN_VIEW setting to enforce global authentication. Be aware this may restrict legitimate public access.
• Audit Access Logs: Review container registry access logs for any signs of unauthorized pull requests or anomalous activity.
• Rotate Credentials: Promptly rotate any API keys, database credentials, cloud access tokens, or other sensitive information that might have been embedded within container images and potentially exposed.
• Review CI/CD Workflows: Assess existing CI/CD workflows and container storage practices to ensure that sensitive data is not being inadvertently stored in container images.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.