{"id":1759,"date":"2026-07-14T07:22:43","date_gmt":"2026-07-14T00:22:43","guid":{"rendered":"https:\/\/vncybers.vn\/gitea-docker-cve-2026-20896-mao-danh-quan-tri-vien\/"},"modified":"2026-07-14T07:22:43","modified_gmt":"2026-07-14T00:22:43","slug":"gitea-docker-cve-2026-20896-mao-danh-quan-tri-vien","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/gitea-docker-cve-2026-20896-mao-danh-quan-tri-vien\/","title":{"rendered":"C\u1ea3nh b\u00e1o Gitea Docker: L\u1ed7 h\u1ed5ng CVE-2026-20896 cho ph\u00e9p m\u1ea1o danh qu\u1ea3n tr\u1ecb vi\u00ean"},"content":{"rendered":"

M\u1ed9t l\u1ed7 h\u1ed5ng nghi\u00eam tr\u1ecdng trong image Docker ch\u00ednh th\u1ee9c c\u1ee7a Gitea \u0111ang b\u1ecb khai th\u00e1c th\u1ef1c t\u1ebf, cho ph\u00e9p k\u1ebb t\u1ea5n c\u00f4ng v\u01b0\u1ee3t qua x\u00e1c th\u1ef1c v\u00e0 m\u1ea1o danh b\u1ea5t k\u1ef3 ng\u01b0\u1eddi d\u00f9ng n\u00e0o, k\u1ec3 c\u1ea3 t\u00e0i kho\u1ea3n qu\u1ea3n tr\u1ecb vi\u00ean. V\u1ea5n \u0111\u1ec1 \u0111\u01b0\u1ee3c theo d\u00f5i v\u1edbi m\u00e3 CVE-2026-20896<\/strong>, \u1ea3nh h\u01b0\u1edfng \u0111\u1ebfn c\u00e1c tri\u1ec3n khai d\u00f9ng c\u1ea5u h\u00ecnh m\u1eb7c \u0111\u1ecbnh khi b\u1eadt c\u01a1 ch\u1ebf x\u00e1c th\u1ef1c qua reverse proxy.<\/p>\n

Th\u00f4ng tin do BleepingComputer t\u1ed5ng h\u1ee3p t\u1eeb c\u1ea3nh b\u00e1o c\u1ee7a Sysdig v\u00e0 c\u1ed1 v\u1ea5n b\u1ea3o m\u1eadt Gitea cho th\u1ea5y \u0111i\u1ec3m y\u1ebfu n\u1eb1m \u1edf c\u00e1ch image Docker tin c\u1eady header x\u00e1c th\u1ef1c t\u1eeb proxy. Trong m\u1ed9t s\u1ed1 c\u1ea5u h\u00ecnh, gi\u00e1 tr\u1ecb REVERSE_PROXY_TRUSTED_PROXIES=*<\/code> khi\u1ebfn Gitea ch\u1ea5p nh\u1eadn header nh\u01b0 X-WEBAUTH-USER<\/code> t\u1eeb b\u1ea5t k\u1ef3 \u0111\u1ecba ch\u1ec9 IP n\u00e0o c\u00f3 th\u1ec3 truy c\u1eadp tr\u1ef1c ti\u1ebfp c\u1ed5ng HTTP c\u1ee7a container.<\/p>\n

\"M\u00e3<\/p>\n

V\u00ec sao l\u1ed7 h\u1ed5ng n\u00e0y nguy hi\u1ec3m<\/h2>\n

Gitea l\u00e0 n\u1ec1n t\u1ea3ng Git t\u1ef1 l\u01b0u tr\u1eef, th\u01b0\u1eddng d\u00f9ng \u0111\u1ec3 qu\u1ea3n l\u00fd m\u00e3 ngu\u1ed3n, pull request, c\u1ed9ng t\u00e1c ph\u00e1t tri\u1ec3n v\u00e0 quy tr\u00ecnh CI\/CD. Khi h\u1ec7 th\u1ed1ng l\u01b0u tr\u1eef m\u00e3 ngu\u1ed3n b\u1ecb chi\u1ebfm quy\u1ec1n, r\u1ee7i ro kh\u00f4ng ch\u1ec9 d\u1eebng \u1edf m\u1ed9t m\u00e1y ch\u1ee7 \u1ee9ng d\u1ee5ng m\u00e0 c\u00f3 th\u1ec3 lan sang b\u00ed m\u1eadt tri\u1ec3n khai, kh\u00f3a truy c\u1eadp, pipeline v\u00e0 to\u00e0n b\u1ed9 chu\u1ed7i cung \u1ee9ng ph\u1ea7n m\u1ec1m.<\/p>\n

Trong k\u1ecbch b\u1ea3n b\u1ecb \u1ea3nh h\u01b0\u1edfng, k\u1ebb t\u1ea5n c\u00f4ng kh\u00f4ng c\u1ea7n m\u1eadt kh\u1ea9u ho\u1eb7c token. N\u1ebfu bi\u1ebft ho\u1eb7c \u0111o\u00e1n \u0111\u01b0\u1ee3c t\u00ean \u0111\u0103ng nh\u1eadp, \u0111\u1eb7c bi\u1ec7t l\u00e0 c\u00e1c t\u00ean ph\u1ed5 bi\u1ebfn nh\u01b0 admin<\/code> or gitea_admin<\/code>, k\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 g\u1eedi header x\u00e1c th\u1ef1c t\u1ef1 khai b\u00e1o \u0111\u1ec3 Gitea tin r\u1eb1ng y\u00eau c\u1ea7u \u0111\u1ebfn t\u1eeb ng\u01b0\u1eddi d\u00f9ng h\u1ee3p l\u1ec7.<\/p>\n

Ph\u1ea1m vi \u1ea3nh h\u01b0\u1edfng v\u00e0 d\u1ea5u hi\u1ec7u khai th\u00e1c<\/h2>\n

Theo c\u1ed1 v\u1ea5n b\u1ea3o m\u1eadt c\u1ee7a Gitea, CVE-2026-20896<\/strong> \u1ea3nh h\u01b0\u1edfng \u0111\u1ebfn c\u00e1c image Docker ch\u00ednh th\u1ee9c \u0111\u1ebfn phi\u00ean b\u1ea3n 1.26.2 khi d\u00f9ng c\u1ea5u h\u00ecnh m\u1eb7c \u0111\u1ecbnh li\u00ean quan \u0111\u1ebfn reverse proxy authentication. Sysdig cho bi\u1ebft \u0111\u00e3 ghi nh\u1eadn ho\u1ea1t \u0111\u1ed9ng khai th\u00e1c th\u1ef1c t\u1ebf sau khi l\u1ed7 h\u1ed5ng \u0111\u01b0\u1ee3c c\u00f4ng b\u1ed1, trong \u0111\u00f3 c\u00f3 tr\u01b0\u1eddng h\u1ee3p m\u00e1y qu\u00e9t t\u1eeb h\u1ea1 t\u1ea7ng VPN th\u1eed truy c\u1eadp b\u1eb1ng k\u1ef9 thu\u1eadt m\u1ea1o danh header.<\/p>\n

BleepingComputer d\u1eabn d\u1eef li\u1ec7u cho th\u1ea5y c\u00f3 kho\u1ea3ng 6.200 phi\u00ean b\u1ea3n Gitea \u0111ang ph\u01a1i l\u1ed9 tr\u00ean web c\u00f4ng c\u1ed9ng, d\u00f9 ch\u01b0a r\u00f5 bao nhi\u00eau h\u1ec7 th\u1ed1ng th\u1ef1c s\u1ef1 d\u00f9ng c\u1ea5u h\u00ecnh d\u1ec5 b\u1ecb khai th\u00e1c. C\u01a1 quan An ninh m\u1ea1ng Singapore c\u0169ng \u0111\u00e3 ph\u00e1t c\u1ea3nh b\u00e1o v\u1ec1 vi\u1ec7c l\u1ed7 h\u1ed5ng n\u00e0y \u0111ang b\u1ecb khai th\u00e1c.<\/p>\n

Recommendations for Administrators<\/h2>\n

Gitea \u0111\u00e3 ph\u00e1t h\u00e0nh c\u00e1c b\u1ea3n 1.26.3 v\u00e0 1.26.4 \u0111\u1ec3 x\u1eed l\u00fd v\u1ea5n \u0111\u1ec1. Qu\u1ea3n tr\u1ecb vi\u00ean n\u00ean n\u00e2ng c\u1ea5p tr\u1ef1c ti\u1ebfp l\u00ean phi\u00ean b\u1ea3n m\u1edbi nh\u1ea5t thay v\u00ec d\u1eebng \u1edf b\u1ea3n v\u00e1 trung gian, v\u00ec b\u1ea3n ph\u00e1t h\u00e0nh sau c\u00f2n x\u1eed l\u00fd th\u00eam l\u1ed7i v\u00e0 h\u1ed3i quy li\u00ean quan.<\/p>\n

N\u1ebfu ch\u01b0a th\u1ec3 n\u00e2ng c\u1ea5p ngay, c\u1ea5u h\u00ecnh REVERSE_PROXY_TRUSTED_PROXIES<\/code> c\u1ea7n \u0111\u01b0\u1ee3c gi\u1edbi h\u1ea1n v\u1ec1 \u0111\u00fang \u0111\u1ecba ch\u1ec9 IP c\u1ee7a reverse proxy tin c\u1eady, thay v\u00ec d\u00f9ng k\u00fd t\u1ef1 \u0111\u1ea1i di\u1ec7n. \u0110\u1ed3ng th\u1eddi, \u0111\u1ed9i v\u1eadn h\u00e0nh n\u00ean r\u00e0 so\u00e1t access log \u0111\u1ec3 t\u00ecm c\u00e1c y\u00eau c\u1ea7u c\u00f3 header x\u00e1c th\u1ef1c b\u1ea5t th\u01b0\u1eddng, \u0111\u1eb7c bi\u1ec7t l\u00e0 truy c\u1eadp tr\u1ef1c ti\u1ebfp t\u1edbi c\u1ed5ng HTTP c\u1ee7a container ho\u1eb7c c\u00e1c l\u1ea7n \u0111\u0103ng nh\u1eadp \u0111\u1ed9t ng\u1ed9t v\u00e0o t\u00e0i kho\u1ea3n c\u00f3 quy\u1ec1n cao.<\/p>\n

B\u00e0i h\u1ecdc cho m\u00f4i tr\u01b0\u1eddng DevOps<\/h2>\n

S\u1ef1 c\u1ed1 cho th\u1ea5y c\u1ea5u h\u00ecnh m\u1eb7c \u0111\u1ecbnh trong container c\u00f3 th\u1ec3 tr\u1edf th\u00e0nh \u0111i\u1ec3m y\u1ebfu nghi\u00eam tr\u1ecdng khi \u0111i v\u00e0o m\u00f4i tr\u01b0\u1eddng s\u1ea3n xu\u1ea5t. V\u1edbi c\u00e1c h\u1ec7 th\u1ed1ng qu\u1ea3n l\u00fd m\u00e3 ngu\u1ed3n, nguy\u00ean t\u1eafc ph\u00f2ng th\u1ee7 c\u1ea7n bao g\u1ed3m c\u00f4 l\u1eadp m\u1ea1ng n\u1ed9i b\u1ed9 cho container, ch\u1ec9 cho ph\u00e9p reverse proxy h\u1ee3p l\u1ec7 ti\u1ebfp c\u1eadn c\u1ed5ng d\u1ecbch v\u1ee5, b\u1eadt ghi log chi ti\u1ebft v\u00e0 ki\u1ec3m tra l\u1ea1i c\u00e1c header \u0111\u01b0\u1ee3c tin c\u1eady.<\/p>\n

\u0110\u1ed1i v\u1edbi t\u1ed5 ch\u1ee9c \u0111ang v\u1eadn h\u00e0nh Gitea, \u01b0u ti\u00ean hi\u1ec7n t\u1ea1i l\u00e0 x\u00e1c \u0111\u1ecbnh phi\u00ean b\u1ea3n image, ki\u1ec3m tra c\u1ea5u h\u00ecnh reverse proxy, c\u1eadp nh\u1eadt l\u00ean b\u1ea3n an to\u00e0n v\u00e0 r\u00e0 so\u00e1t d\u1ea5u hi\u1ec7u truy c\u1eadp b\u1ea5t th\u01b0\u1eddng. \u0110\u00e2y c\u0169ng l\u00e0 th\u1eddi \u0111i\u1ec3m ph\u00f9 h\u1ee3p \u0111\u1ec3 \u0111\u00e1nh gi\u00e1 l\u1ea1i c\u00e1ch qu\u1ea3n l\u00fd b\u00ed m\u1eadt trong repository, quy\u1ec1n c\u1ee7a t\u00e0i kho\u1ea3n qu\u1ea3n tr\u1ecb v\u00e0 \u0111\u01b0\u1eddng \u0111i c\u1ee7a pipeline tri\u1ec3n khai.<\/p>\n

VNCyberS<\/strong> t\u1ed5ng h\u1ee3p t\u1eeb BleepingComputer, Gitea, Sysdig v\u00e0 CSA Singapore<\/em><\/p>","protected":false},"excerpt":{"rendered":"

M\u1ed9t l\u1ed7 h\u1ed5ng nghi\u00eam tr\u1ecdng trong image Docker ch\u00ednh th\u1ee9c c\u1ee7a Gitea \u0111ang b\u1ecb khai th\u00e1c th\u1ef1c t\u1ebf, cho ph\u00e9p k\u1ebb t\u1ea5n c\u00f4ng v\u01b0\u1ee3t qua x\u00e1c th\u1ef1c v\u00e0 m\u1ea1o danh b\u1ea5t k\u1ef3 ng\u01b0\u1eddi d\u00f9ng n\u00e0o, k\u1ec3 c\u1ea3 t\u00e0i kho\u1ea3n qu\u1ea3n tr\u1ecb vi\u00ean. V\u1ea5n \u0111\u1ec1 \u0111\u01b0\u1ee3c theo d\u00f5i v\u1edbi m\u00e3 CVE-2026-20896, \u1ea3nh h\u01b0\u1edfng \u0111\u1ebfn c\u00e1c tri\u1ec3n […]<\/p>\n","protected":false},"author":2,"featured_media":1758,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[370,374,368,372,369,367,371,373],"class_list":["post-1759","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tin-tuc","tag-authentication-bypass","tag-csa-singapore","tag-cve-2026-20896","tag-devops-security","tag-docker","tag-gitea","tag-reverse-proxy","tag-sysdig"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1759","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=1759"}],"version-history":[{"count":0,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1759\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/1758"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=1759"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=1759"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=1759"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}