TLDR Tech / InfoSec
Gitea Flaw Left 30,000 Deployments' Private Container Images Readable for 4 Years
A Gitea container registry bug (CVE-2026-27771) allowed unauthenticated users to pull “private” images for about four years, exposing code, secrets, and production wiring across roughly 30,000 self-hosted Gitea and Forgejo instances in sectors such as healthcare, aerospace, SaaS, and ISPs. Operators should upgrade to Gitea v1.26.2, consider setting REQUIRE_SIGNIN_VIEW=true as a stopgap, and audit registry logs for suspicious pulls.
Read the full story