CVE-2026-27771Disclosure

HIGHCVSS 8.2 · HIGH

Exploitation observed; activity peaked at 10 mentions and remains active

Immediate actions

Patch affected systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information.

Back to dashboard

7.8/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-862

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Threat summary

Active exploitation appears in 7 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
31 mentions across 10 observed days

What's happening

Active exploitation reported across 7 signals
Exploit tool or code specified in 2 signals
PoC mentioned or linked in 3 signals
Patch or workaround mentioned in 17 signals
Technical details provided in 20 signals
Disclosure: 12 classified signals
Peaked 7d ago at 10 mentions (2026-05-28); latest day: 2
31 total mentions across 10 days

Deep dive

Activity timeline31 mentions / 10d

Signal classification6 categories

Disclosure

1240.0%

Patch

930.0%

Active Exploitation

310.0%

PoC

310.0%

General

26.7%

Disclosures

13.3%

Referenced assets17 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-26	2	Disclosure2
2026-05-27	9	Active Exploitation1Disclosure3Disclosures1Patch3PoC1
2026-05-28	10	Active Exploitation2Disclosure5General1Patch1PoC1
2026-05-29	3	Disclosure2General1
2026-06-03	1	Patch1
2026-06-14	1	Patch1
2026-06-16	1	Patch1
2026-07-11	1	Patch1
2026-07-18	1	Patch1
2026-09-29	2	PoC1

Full discourse20 posts

The Hacker News@TheHackersNews137d
Patch
🚨 Gitea flaw exposes private container images without authentication. https://thehackernews.com/2026/05/gitea-vulnerability-exposes-private.html CVE-2026-27771 affects all Gitea versions before 1.26.2 and likely impacts 30,000+ deployments worldwide. Attackers can pull private images without an account or password. Update now or enable REQUIRE_SIGNIN_VIEW as a temporary workaround.
Post summary
The article discloses a Gitea flaw that lets attackers access private container images without authentication and recommends upgrading to 1.26.2 or enabling the REQUIRE_SIGNIN_VIEW workaround.
74091553643.0K
1.9M followersView on X
The Hacker News@TheHackersNews136d
Patch
A quick update on the Gitea vulnerability. Over 30,000 instances may still be exposed. The flaw (CVE-2026-27771) lets anyone pull private container images without authentication. Many organizations have not patched yet. If you run Gitea, check your version immediately and update to 1.26.2 or later. Temporary workaround: Enable REQUIRE_SIGNIN_VIEW.
Post summary
The post confirms that CVE-2026-27771 exposes over 30,000 Gitea instances and urges users to upgrade to version 1.26.2 or later or enable REQUIRE_SIGNIN_VIEW as a temporary workaround.
7241731819.1K
1.9M followersView on X
portbuster@portbuster1337137d
PoC
new poc repo for the new gitea cve https://github.com/portbuster1337/CVE-2026-27771 references: https://thehackernews.com/2026/05/gitea-vulnerability-exposes-private.html https://www.noscope.com/blog/gitea-instances-exposing-private-container
Post summary
A Proof of Concept repository for the newly disclosed Gitea CVE‑2026‑27771 has been shared, with linked references to related news coverage.
014249223.7K
151 followersView on X
NoScope@trynoscope138d
Disclosure
For 4 years, any person on the internet could pull private container images from 30,000+ Gitea deployments. No account. No password. No credentials of any kind. NoScope discovered it. CVE-2026-27771. Here's the full story. 🧵 https://t.co/xlSES5FjQN
Post summary
NoScope publicly disclosed CVE-2026-27771, revealing that for four years unauthenticated users could retrieve private container images from over 30,000 Gitea installations.
45221185.6K
131 followersView on X
Ryx@PadhiyarRushi12d
Gitea ghost user (UserID -1) pulls every private container. Middleware never checked package owner. CVE-2026-2777: ReqContainerAccess only tests RequireSignInViewStrict. Ghost sessions enumerate repos, tags, manifests, and layers. Scan + pull PoC is public! Fixed in 1.26.2 https://github.com/portbuster1337/CVE-2026-27771 #Cybersecurity #AI #AISecurity #MCP #Claude #GPT #Infosec #Trending #AppSec #SupplyChain #AuthBypass
21082541
953 followersView on X
Horizon3.ai@Horizon3ai135d
General
🚨 A private container registry that serves anonymous pulls isn’t private anymore. Rapid Response test now available for CVE-2026-27771 in Gitea. https://t.co/XeksonIUUH
Post summary
A Rapid Response test for CVE-2026-27771 in Gitea has been posted, but the tweet lacks information on PoCs, exploits, patches, or active exploitation.
33150468
2.9K followersView on X
L’algorisme@lalgorisme136d
Active Exploitation
🧵Durant uns 4 anys, qualsevol ha pogut descarregar imatges "privades" de Gitea sense compte ni contrasenya. Hi ha més de 30.000 instàncies afectades en 30 països. L'etiqueta "privat" senzillament no funcionava com s'esperava al registre de contenidors. CVE-2026-27771
Post summary
CVE‑2026‑27771 exposed Gitea container registry’s private images to public download, enabling widespread misuse across 30,000+ instances in 30 countries.
120721.0K
5.9K followersView on X
Ryx@PadhiyarRushi12d
PoC
Gitea ghost user (UserID -1) can pull every private container. Middleware never checked package visibility! CVE-2026-27771: ReqContainerAccess only looks at RequireSignInViewStrict. Ghost sessions enumerate repos, tags, manifests, and layers with no owner check. Scan + pull PoC is public. Fixed in 1.26.2. https://github.com/portbuster1337/CVE-2026-27771 https://blog.gitea.com/release-of-1.26.2/ #Cybersecurity #AI #AISecurity #MCP #Claude #GPT #Infosec #Trending #AppSec #SupplyChain #AuthBypass
Post summary
The tweet discloses CVE-2026-27771 in Gitea with technical details and confirms a public PoC on GitHub, while noting the issue is fixed in version 1.26.2.
00191547
953 followersView on X
NoScope@trynoscope137d
Disclosure
NoScope's AI agent discovered an important vulnerability (CVE-2026-27771) in Gitea, one of the most widely used self-hosted Git platforms. The finding is now being discussed across @TheHackersNews and the broader security community. If Gitea is part of the stack, patch it now. More details: https://www.noscope.com/blog/gitea-instances-exposing-private-container
Post summary
NoScope’s AI agent identified a critical vulnerability (CVE‑2026‑27771) in Gitea, triggering discussion and a clear call to apply the available patch to mitigate the risk.
020701.3K
131 followersView on X
CiberBaur@BotBauR137d
Patch
🚨 Acaba de confirmarse: una vulnerabilidad en Gitea expone imágenes de contenedores privados sin autenticación. La vulnerabilidad, identificada como CVE-2026-27771, afecta todas las versiones de Gitea anteriores a la 1.26.2. Esto significa que atacantes remotos pueden acceder a imágenes de contenedores privados sin necesidad de cuenta, contraseña o credenciales. La exposición de imágenes de contenedores privados puede ocurrir debido a un control de acceso incorrecto en los endpoints del registry. Esto puede permitir a los atacantes acceder a información confidencial. Los sistemas afectados deben actualizar a la versión 1.26.2 o superior de Gitea para mitigar esta vulnerabilidad. Si estás utilizando Gitea, es importante que revises tu configuración y actualices tu sistema lo antes posible. ¿Estás en riesgo? Revisa esto: actualiza Gitea a la versión 1.26.2 o superior. https://thehackernews.com/2026/05/gitea-vulnerability-exposes-private.html
Post summary
Se confirma la existencia de un CVE que expone imágenes de contenedores privados en Gitea anteriores a la 1.26.2, y se recomienda actualizar a la versión 1.26.2 o superior para mitigar la vulnerabilidad de control de acceso.
02041246
460 followersView on X
Orca Security@orcasec137d
Disclosure
🚨 Critical vulnerability alert: CVE-2026-27771 Your private container images might not be so private. CVE-2026-27771 lets anyone pull private Gitea images with zero credentials. Source code, API keys, database passwords... all exposed. How to fix: https://orca.security/resources/blog/gitea-container-registry-vulnerability/?utm_source=twitter&utm_medium=organic+social&utm_campaign=orca+blog https://t.co/XdFcKfuFdZ
Post summary
CVE‑2026‑27771 permits unauthenticated access to private Gitea container images, exposing sensitive data; a fix is linked in the post.
11050840
4.8K followersView on X
Andre Gironda@AndreGironda136d
PoC
CVE-2026-27771 targets a Gitea container registry authorization bypass affecting versions before 1.26.2. -- https://github.com/portbuster1337/CVE-2026-27771
Post summary
CVE-2026-27771 is an authorization bypass in Gitea container registry versions <1.26.2, with a PoC available on a GitHub repository.
02031486
3.8K followersView on X
Jamaica Cyber Incident Response Team (JaCIRT)@cirtgovjm135d
Disclosure
🚨URGENT ADVISORY🚨Cybersecurity researchers have disclosed a critical vulnerability tracked as CVE-2026-27771, affecting Gitea. Click here for more information👇 https://cirt.gov.jm/advisory/gitea-vulnerability-could-allow-unauthenticated-access-private-container-images https://t.co/dvy7fW9Wyd
Post summary
The tweet announces the discovery of CVE‑2026‑27771 in Gitea and links to an external advisory for more details.
12020240
1.2K followersView on X
ボス@サイバーセキュリティの専門家@boss_sec_labo136d
General
今日まとめたのは13本。半分がパッチで止められる傷、残りはもう悪用が始まっているか、4年潜伏していた古傷だ。「うちは関係ない」で読み飛ばすな。・三菱電機GX Works3など複数FA製品、CVSS8.3のRCE ・Jupyter Server CVE-2025-61669、フィッシング踏み台に・Ubiquiti UniFi OS、遠隔影響のクリティカル脆弱性・IBM ELMのJazz Foundationに脆弱性、パッチ公開・Veeamバックアップ製品に脆弱性、修正版公開・Google Cloud Apigee SSRF、認証トークン窃取の恐れ・FortiClient EMS CVE-2026-35616悪用、EKZ infostealer拡散・Gitea CVE-2026-27771、4年未検出・3万超デプロイに影響・Carnival Cruise、ShinyHunters侵害で600万人流出を公式認定・Glassworm、ブロックチェーンC2を解体され制圧・FBI警告、Silent Ransom Groupが法律事務所に物理侵入・GPUマイナー、SEO汚染とAIチャットボット推奨経由で拡散・IPA、5ヶ月指名停止で独法の脆弱性監査が停止パッチで止まる傷と、もう手遅れの傷が同じ日に並んでいる。君の現場で今夜、最初に手を付けるべき1本はどれだ？
Post summary
The post summarizes thirteen CVEs, noting which have patches, which are actively exploited, and giving brief technical descriptors for each.
00012850
498 followersView on X
Agent X AGI@agentxagi136d
Disclosure
AI agent found CVE-2026-27771 in Gitea. 30,000+ instances exposed for 4 years. Unauthenticated container pulls of private images. Humans missed it. The agent got official credit in the patch. → http://noscope.com/blog/gitea-instances-exposing-private-container
Post summary
An AI agent uncovered CVE‑2026‑27771 in Gitea, exposing over 30,000 instances to unauthenticated container pulls for four years, prompting the vendor to issue a patch that credited the AI.
1002071
391 followersView on X
Upwind Security MDR@UpwindMDR137d
Disclosure
🚨 High - Gitea Private Container Image Exposure (CVE-2026-27771) A critical flaw in Gitea’s container registry allows unauthenticated remote attackers to pull private container images without any login or credentials. The "private" flag was not properly enforced, exposing sensitive Docker/OCI images publicly. This issue likely affected over 30,000 deployments worldwide and remained undetected for nearly 4 years. 👉Affected: Gitea < 1.26.2 (including forks like Forgejo) | Upgrade to Gitea 1.26.2 (the latest stable version)
Post summary
CVE-2026-27771 is a critical flaw in Gitea’s container registry that lets attackers pull private images without credentials, affecting over 30,000 deployments; users of Gitea <1.26.2 should upgrade to the latest stable version.
10020117
196 followersView on X
UNDERCODE TESTING@UndercodeUpdate137d
Disclosures
🚨 Gitea Under Fire: Critical #CVE-2026-27771 Leaks Your Private Containers to the World! + Video https://undercodetesting.com/gitea-under-fire-critical-cve-2026-27771-leaks-your-private-containers-to-the-world-video/ Educational Purposes!
Post summary
The post announces CVE-2026-27771 as a critical issue affecting Gitea, highlighting a privacy leak, but does not provide technical details, a PoC, or evidence of active exploitation.
0003085
661 followersView on X
NoScope@trynoscope138d
Disclosure
Gitea assigned CVE-2026-27771 and officially credited NoScope in the v1.26.2 release. At no point was any private image content accessed from any third-party host. All research was conducted in a controlled environment.
Post summary
The post announces that Gitea has assigned CVE‑2026‑27771 and credited NoScope in the v1.26.2 release, without providing any PoC, exploit, patch, technical details, or evidence of active exploitation.
10011219
105 followersView on X
Matt Fagala@MattFagala137d
Patch
Gitea CVE-2026-27771: unauthenticated users can pull your private container images. No account, no password, just an API call. Affects 30K+ self-hosted deployments. Patch to 1.26.2 or assume everything is already gone.
Post summary
Unauthenticated API calls enable pulling private container images in Gitea; upgrading to version 1.26.2 mitigates the vulnerability.
0002074
358 followersView on X
AI Security Gateway@AISGateway136d
Disclosure
🔐CVE-2026-27771: unauthenticated attackers can pull private container images from Gitea without a single credential. If your AI stack is self-hosted and Gitea-managed, your model configs, prompts, and provider keys may be sitting in those repos.
Post summary
CVE-2026-27771 enables unauthenticated attackers to access private Gitea container images, potentially exposing AI stack configuration and credentials.
1000051
40 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-27771

NoScope[verified]@trynoscopeDisclosure

NoScope publicly disclosed CVE-2026-27771, revealing that for four years unauthenticated users could retrieve private container images from over 30,000 Gitea installations.

Horizon3.ai[verified]@Horizon3aiGeneral

A Rapid Response test for CVE-2026-27771 in Gitea has been posted, but the tweet lacks information on PoCs, exploits, patches, or active exploitation.

Ryx[verified]@PadhiyarRushiPoC

The tweet discloses CVE-2026-27771 in Gitea with technical details and confirms a public PoC on GitHub, while noting the issue is fixed in version 1.26.2.

NoScope[verified]@trynoscopeDisclosure

NoScope’s AI agent identified a critical vulnerability (CVE‑2026‑27771) in Gitea, triggering discussion and a clear call to apply the available patch to mitigate the risk.

CiberBaur[verified]@BotBauRPatch

Se confirma la existencia de un CVE que expone imágenes de contenedores privados en Gitea anteriores a la 1.26.2, y se recomienda actualizar a la versión 1.26.2 o superior para mitigar la vulnerabilidad de control de acceso.

ボス@サイバーセキュリティの専門家[verified]@boss_sec_laboGeneral

The post summarizes thirteen CVEs, noting which have patches, which are actively exploited, and giving brief technical descriptors for each.

Upwind Security MDR[verified]@UpwindMDRDisclosure

CVE-2026-27771 is a critical flaw in Gitea’s container registry that lets attackers pull private images without credentials, affecting over 30,000 deployments; users of Gitea <1.26.2 should upgrade to the latest stable version.

UNDERCODE TESTING[verified]@UndercodeUpdateDisclosures

The post announces CVE-2026-27771 as a critical issue affecting Gitea, highlighting a privacy leak, but does not provide technical details, a PoC, or evidence of active exploitation.