Gitea CVE: Private Container Images Exposed for Four Years

Gitea CVE-2026-27771 is a critical container registry vulnerability. It allowed unauthenticated attackers to access private images for nearly four years. The flaw impacts more than 30,000 Gitea deployments worldwide. Consequently, organizations using the popular self-hosted Git platform must patch immediately or risk exposing sensitive containerized workloads.

What Happened: Gitea Container Registry Leaked Private Images for Four Years

On May 27, 2026, security researchers at Noscope disclosed CVE-2026-27771. The vulnerability affects Gitea’s built-in container registry. Moreover, the flaw allowed any internet user to pull private container images without authentication.

The issue went undetected for close to four years. It impacts all Gitea versions prior to 1.26.2. Furthermore, the popular Forgejo fork has also been confirmed vulnerable. Affected organizations span healthcare, aerospace, retail, and internet service providers across over 30 countries.

Noscope co-founder Keval Jagani told The Hacker News that technical specifics were intentionally withheld. This gives the broader Gitea ecosystem time to patch before full exploitation details become public. However, the risk remains acute for unpatched instances.

Technical Details of the Gitea Container Registry Vulnerability

Gitea is an open-source, self-hosted platform for version control. It also provides a built-in container registry for hosting Docker and OCI-compatible images. Operators can mark container repositories as private. However, on affected versions, this designation did not enforce authentication for image pulls.

As a result, unauthenticated remote attackers could pull private container images as if they were public. No account, password, or prior access was required. The vulnerability stems from improper access control enforcement within the container registry routing logic.

The flaw is particularly dangerous because container images often contain more than application code. They frequently include configuration files, environment variables, and build secrets. Therefore, an attacker who pulls a private image can extract sensitive artifacts without ever compromising the host system.

The following conditions increase risk:

• Gitea instances with the container registry enabled
• Repositories marked private that contain container images
• Instances directly exposed to the internet without additional access controls
• Organizations using forks such as Forgejo that inherited the vulnerable code

In addition, Noscope noted that any fork of Gitea should be treated as potentially impacted. Independent verification by respective maintainers is required to confirm immunity.

Business and Operational Impact

Noscope estimates that over 30,000 deployments are exposed globally. The majority of affected instances are located in China, the United States, Germany, France, and the United Kingdom. Therefore, the blast radius is significant and spans multiple critical sectors.

Exposed private container images can contain:

• Hardcoded credentials and API keys for cloud services and databases
• Proprietary source code and build artifacts
• Internal application configurations and environment variables
• Base images with unpatched vulnerabilities that attackers can weaponize

For healthcare providers, this raises HIPAA compliance concerns. Patient data could be exposed if medical applications run from compromised container images. Aerospace manufacturers risk intellectual property theft and export control violations. Retailers face payment card industry scrutiny if e-commerce containers leak secrets. Internet service providers could see customer management platforms compromised.

Moreover, the four-year window means attackers may have already discovered and exploited this flaw silently. Organizations should assume that any private image hosted on an unpatched Gitea instance prior to disclosure has been accessed by unauthorized parties.

Mitigation and Recommendations

Immediate Actions for Defenders

1. Upgrade Gitea to version 1.26.2 immediately. This release patches the access control flaw.
2. If patching is not immediately possible, set [service].REQUIRE_SIGNIN_VIEW = true in Gitea configuration. Note that this will require authentication for all public content. This may break intentionally public containers.
3. Audit container registry access logs for anomalous pull activity from unknown IP addresses.
4. Rotate any credentials, API keys, or secrets that may have been embedded in private container images.
5. Review all forks and downstream platforms for the same vulnerability.

Long-Term Hardening Measures

• Enable comprehensive registry access logging and monitoring
• Implement network segmentation to limit container registry exposure
• Regularly scan container images for embedded secrets using tools like Trivy or TruffleHog
• Subscribe to Gitea security advisories for early notification of future flaws
• Consider adding an external authentication proxy in front of the container registry

Bottom line: Gitea CVE-2026-27771 is a silent, long-standing exposure that bypassed the privacy controls organizations trusted for years. Patching to 1.26.2 and rotating potentially exposed secrets are non-negotiable first steps.

Incident Summary

CVE ID / Incident:	CVE-2026-27771
Affected Systems:	Gitea versions prior to 1.26.2; Forgejo fork confirmed impacted
Disclosure Date:	May 27, 2026
Patch Status:	Available in Gitea 1.26.2
CVSS Score:	8.2
Estimated Exposed Deployments:	30,000+ across 30+ countries

References

1. The Hacker News, “Gitea Vulnerability Exposes Private Container Images without Authentication,” May 27, 2026, https://thehackernews.com/2026/05/gitea-vulnerability-exposes-private.html (accessed May 28, 2026).
2. Noscope, “Gitea Instances Exposing Private Container Images,” May 27, 2026, https://www.noscope.com/blog/gitea-instances-exposing-private-container (accessed May 28, 2026).
3. Gitea, “Release of Gitea 1.26.2,” May 2026, https://blog.gitea.com/release-of-1.26.2/ (accessed May 28, 2026).
4. National Vulnerability Database, “CVE-2026-27771,” https://nvd.nist.gov/vuln/detail/CVE-2026-27771 (accessed May 28, 2026).