--- title: Gitea CVE-2026-20896 under active exploitation, KVM... description: A critical Gitea Docker vulnerability (CVE-2026-20896, CVSS 9.8) is being actively probed just 13 days after a patch dropped — roughly 6,200 internet-facing... canonical: https://daily.dev/posts/gitea-cve-2026-20896-under-active-exploitation-kvm-guest-to-host-escape-disclosed-vdti5qvtm twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Gitea CVE-2026-20896 under active exploitation, KVM guest-to-host escape disclosed | daily.dev og:description: A critical Gitea Docker vulnerability (CVE-2026-20896, CVSS 9.8) is being actively probed just 13 days after a patch dropped — roughly 6,200 internet-facing... og:url: https://daily.dev/posts/gitea-cve-2026-20896-under-active-exploitation-kvm-guest-to-host-escape-disclosed-vdti5qvtm og:image: https://api.daily.dev/og/posts/VdTI5qVtM.png og:image:alt: Gitea CVE-2026-20896 under active exploitation, KVM guest-to-host escape disclosed og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Gitea CVE-2026-20896 under active exploitation, KVM guest-to-host escape disclosed **[Backend Digest](https://daily.dev/sources/backend_digest)** · 4 min read · 0 upvotes · 0 comments ## Summary A critical Gitea Docker vulnerability (CVE-2026-20896, CVSS 9.8) is being actively probed just 13 days after a patch dropped — roughly 6,200 internet-facing instances are exposed. Separately, a 16-year-old KVM flaw (CVE-2026-53359) lets a guest VM root escape to the host on both Intel and AMD, with a DoS PoC already public. On the data side, Momentic migrated from PostgreSQL to ClickHouse to handle growth from 80,000 to 20 billion cache entries. PostgreSQL 18.2 introduced three serious regressions severe enough to trigger an out-of-cycle 18.3 release. ## Content **TLDR:** A critical Gitea Docker vulnerability (CVE-2026-20896, CVSS 9.8) is being actively probed just 13 days after a patch dropped — roughly 6,200 internet-facing instances are exposed. Separately, a 16-year-old KVM flaw (CVE-2026-53359) lets a guest VM root escape to the host on both Intel and AMD, with a DoS PoC already public. On the data side, Momentic migrated from PostgreSQL to ClickHouse to handle growth from 80,000 to 20 billion cache entries. PostgreSQL 18.2 introduced three serious regressions severe enough to trigger an out-of-cycle 18.3 release. --- ## Gitea CVE-2026-20896 under active probing, 6,200 instances exposed The flaw is embarrassingly simple: the official Gitea Docker image ships with REVERSE_PROXY_TRUSTED_PROXIES set to a wildcard, so anyone who can reach the container's HTTP port can forge an X-WEBAUTH-USER header and impersonate any user, including admins. Sysdig caught the first in-the-wild probe 13 days after the patch — originating from a ProtonVPN exit node. Gitea 1.26.3 and 1.26.4 fix this along with nine other issues including SSRF and an OAuth2 reactivation flaw. If you're running Gitea in Docker, update now and lock REVERSE_PROXY_TRUSTED_PROXIES to your actual proxy address. [Read more](https://daily.dev/posts/wHnIJN6Ok) ## KVM guest-to-host escape CVE-2026-53359 affects both Intel and AMD x86 Dubbed Januscape, this 16-year-old use-after-free in the Linux KVM module is the first guest-to-host escape confirmed working across both architectures. An attacker with root inside a guest VM can crash the host kernel or gain host root, compromising every co-tenant VM on the machine. The Linux kernel was patched June 16, but distro-level patches may lag. A DoS PoC is already public; the full escape exploit is being withheld for now. If you're running multi-tenant cloud workloads on KVM, check your distro's patch status today. [Read more](https://daily.dev/posts/GX1SCsPVh) ## Momentic migrated from PostgreSQL to ClickHouse to handle 80K to 20B cache entries The trigger was explosive growth — 80,000 to 20 billion cache entries while serving over 2 million queries per day at roughly 250ms latency. Key decisions: a composite primary key tuned to ClickHouse's sparse index granules, materialized views for commit timestamp lookups, and INSERT-only patterns with ReplacingMergeTree for deduplication. That last move let them eliminate Redis entirely. Migration used shadow queries with dual writes to validate correctness before shifting production traffic. [Read more](https://daily.dev/posts/kJtwee69g) ## PostgreSQL 18.2 regressions triggered an out-of-cycle 18.3 release Three bugs made 18.2 genuinely dangerous: standbys halting on multixid WAL replay errors, a substring() encoding crash introduced by the CVE-2026-2006 fix, and a pg_trgm segfault from the CVE-2026-2007 fix. The fix is upgrading to 18.3 — no dump/restore needed. Quieter traps in the broader 18.x upgrade path include data checksums now defaulting to on (breaking pg_upgrade when the old cluster had them off) and extension compatibility issues, especially pgvector. [Read more](https://daily.dev/posts/ULZpbKAPY) --- ## Also notable - **Argo CD repo-server gRPC lacks authentication, full Kubernetes cluster takeover possible:** Synacktiv disclosed an unpatched Argo CD vulnerability reported in January 2025 — over 18 months without a fix — where the repo-server's unauthenticated gRPC interface lets an attacker with internal cluster access inject malicious KustomizeOptions for RCE, Redis access, and arbitrary manifest deployment; apply strict Kubernetes network policies as a mitigation now. [Read more](https://daily.dev/posts/kb2oEqMx0) - **GitHub 'GitLost' prompt injection leaks private repo data via public issue comments:** Noma Security found that opening a malicious GitHub Issue in a public repo is enough to trick GitHub's agentic workflows (backed by Claude or Copilot) into exfiltrating data from the organization's private repositories — no credentials required, just plain-English commands in the issue body. [Read more](https://daily.dev/posts/jTY8EOyaf) - **Docker AuthZ bypass CVE-2026-34040 is an incomplete fix of the 2024 maximum-severity CVE-2024-41110:** The same class of attack — a crafted API request reaching Docker authorization plugins without its body — resurfaces in Moby before 29.3.1; upgrade immediately if you use authorization plugins, and stop mounting /var/run/docker.sock into containers as a defense-in-depth measure. [Read more](https://daily.dev/posts/TIN2NDoHk) - **Amazon ECS GPU management fees cut 35-60% effective July 1, 2026:** G-series instances see a 35% fee reduction and P-series plus AWS Trainium instances get a 60% cut — no action required from existing customers, and Amazon EKS Auto Mode is implementing identical reductions for GPU instances. [Read more](https://daily.dev/posts/Pe9bcHiin) - **Node.js 26 ships Temporal API enabled by default, V8 14.6, removes legacy stream modules:** The Temporal API no longer needs an experimental flag, NODE_MODULE_VERSION bumps to 147 requiring native add-on rebuilds, and the _stream_* legacy modules are removed — Node.js 26 enters LTS in October 2026. [Read more](https://daily.dev/posts/8f8Xftnj7) ## Similar posts on daily.dev - [16-year-old KVM flaw allows attackers to escape VMs and take over Linux servers](https://daily.dev/posts/16-year-old-kvm-flaw-allows-attackers-to-escape-vms-and-take-over-linux-servers-gx1scspvh) · CSO Online · 0 upvotes · 0 comments - [Gitea Docker Vulnerability Now Under Active Probing, CVE-2026-20896](https://daily.dev/posts/gitea-docker-vulnerability-now-under-active-probing-cve-2026-20896-whnijn6ok) · Latest Hacking News · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#postgresql](https://daily.dev/tags/postgresql), [#clickhouse](https://daily.dev/tags/clickhouse) [View this post on daily.dev](https://daily.dev/posts/gitea-cve-2026-20896-under-active-exploitation-kvm-guest-to-host-escape-disclosed-vdti5qvtm) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/gitea-cve-2026-20896-under-active-exploitation-kvm-guest-to-host-escape-disclosed-vdti5qvtm","headline":"Gitea CVE-2026-20896 under active exploitation, KVM guest-to-host escape disclosed","text":"A critical Gitea Docker vulnerability (CVE-2026-20896, CVSS 9.8) is being actively probed just 13 days after a patch dropped — roughly 6,200 internet-facing instances are exposed. Separately, a 16-year-old KVM flaw (CVE-2026-53359) lets a guest VM root escape to the host on both Intel and AMD, with a DoS PoC already public. On the data side, Momentic migrated from PostgreSQL to ClickHouse to handle growth from 80,000 to 20 billion cache entries. PostgreSQL 18.2 introduced three serious regressions severe enough to trigger an out-of-cycle 18.3 release.","url":"https://daily.dev/posts/gitea-cve-2026-20896-under-active-exploitation-kvm-guest-to-host-escape-disclosed-vdti5qvtm","datePublished":"2026-07-08T04:18:05.324Z","dateModified":"2026-07-08T04:18:27.435Z","author":{"@type":"Organization","name":"Backend Digest","logo":"https://media.daily.dev/image/upload/s--9uCSrsAb--/f_auto,q_auto/v1773839398/logos/backend_digest?_a=BAMAMiiu0","url":"https://daily.dev/sources/backend_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/backend_digest","name":"Backend Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Backend Digest","item":"https://daily.dev/sources/backend_digest"},{"@type":"ListItem","position":3,"name":"Gitea CVE-2026-20896 under active exploitation, KVM guest-to-host escape disclosed"}]} ```