Please update Gitea and Forgejo, Private Container Images Were Never Private (opens in new tab)

Covers 18-year-old NGINX vulnerability allows DoS, potential RCEDiscussed on r/selfhosted

Gitea CVE-2026-27771 exposed private container images to unauthenticated access for 4 years. 30,000+ deployments affected. Update to Gitea 1.26.2 now.

Read the original article