Affected Systems
Gitea versions prior to 1.26.2. All deployments using Gitea's container registry feature are affected. Unauthenticated remote attackers can pull private container images without credentials.
Exploitation Status
Exploitation status unknown. No public PoC or active exploitation confirmed in available data. Vulnerability is publicly disclosed with CVE assigned.
Business Impact
Organizations using Gitea for private container image storage face immediate confidentiality risk. Attackers can access proprietary application code, secrets embedded in images, and internal tooling without authentication. This enables reconnaissance, intellectual property theft, and potential supply chain attacks. Impact is critical for teams storing production images or images containing credentials, API keys, or sensitive configuration data.
Urgency
🔴 Immediate
Recommended Actions
- Upgrade all Gitea instances to version 1.26.2 or later immediately
- Audit container registry access logs for unauthorized pull requests from unauthenticated sources prior to patching
- Rotate any secrets, API keys, or credentials that may have been embedded in private container images
- If immediate patching is not possible, disable the container registry feature or restrict network access to Gitea container registry endpoints via firewall rules
- Review and harden authentication policies for container registries across the organization