Skip to content

Back to the catalog

orca.securitywriteup

Orca Security: Gitea Container Registry Exposes Private Images to Unauthenticated Attackers

Orca Security describes a vulnerability in Gitea's built-in container registry that allowed unauthenticated attackers to access private container images. The issue highlights access-control gaps in self-hosted Git/CI platforms that bundle registry functionality, potentially exposing proprietary code and secrets baked into private images.

TL;DR Gitea's container registry reportedly let unauthenticated users pull private container images.
Open original ↗

CVEs named here

  • CVE-2026-27771

Technologies named here

  • Gitea built-in container registry
  • NoScope's autonomous penetration testing agent
  • Orca
  • Forgejo
  • Other Gitea forks
  • Gitea

Techniques named here

  • Unauthenticated pull of private container images

Related in AppSec