Gitea Vulnerability Exposes Private Container Images without Authentication
A Gitea flaw let unauthenticated users pull private container images. The issue affects versions before 1.26.2 and may touch tens of thousands of deployments.
Intelligence analysis by GPT-5.4 Mini
Researchers say a Gitea registry bug made private container images retrievable by anyone on the internet, with no login required. The report says the issue, tracked as CVE-2026-27771, may have affected more than 30,000 deployments for years.
A tool that stores software code had a broken lock. Because of that, people who were not supposed to get in could still take private picture boxes of software, called container images.
It is like keeping toys in a closet marked “private,” but the door never actually locked. Anyone walking by could open it and take the toys.
The fix is to update the software. If that cannot happen right away, the article says there is a temporary setting that makes people sign in first, but that is only a stopgap.
Analysis
What happened
Cybersecurity researchers disclosed a flaw in Gitea, the open-source, self-hosted version control platform, that could let unauthenticated remote attackers pull private container images from affected deployments. The report says the issue is tracked as CVE-2026-27771 and is fixed in Gitea 1.26.2.
Scope of exposure
According to Noscope, the problem may have gone unnoticed for close to four years and could affect more than 30,000 deployments across over 30 countries. The article says the largest share of exposed instances are in China, the U.S., Germany, France, and the U.K., and that impacted organizations include healthcare providers, aerospace manufacturers, retail infrastructure, and internet service providers.
Why the flaw matters
Noscope says the private label on a container repository did not provide the protection operators would reasonably expect. In its words, anyone on the internet could pull images that appeared private as if they were public. That matters because container images often contain application code, dependencies, and sometimes configuration data that should not be exposed.
What users should do
The article advises Gitea users to update to 1.26.2. If patching is not immediately possible, it suggests setting [service].REQUIRE_SIGNIN_VIEW=true in the configuration as a temporary workaround, while noting that this is not ideal for images intended to be public. The piece also warns that forks of Gitea should be treated as potentially impacted until their maintainers verify otherwise; Forgejo has already been confirmed impacted in testing.
Key points
- Researchers found a Gitea bug that let unauthenticated users pull private container images.
- The issue is tracked as CVE-2026-27771 and is fixed in Gitea 1.26.2.
- Noscope says the flaw may affect more than 30,000 deployments across over 30 countries.
- The article says forks of Gitea should be treated as potentially impacted until verified by maintainers.
- A temporary workaround is to set `[service].REQUIRE_SIGNIN_VIEW=true` if patching is delayed.
