Unauthenticated RCE in Gitea via diffpatch API Git Hook Injection
CISA: Gitea Code Injection Vulnerability
Gitea before 1.27.1 contains a critical code injection flaw (CWE-94) in the diffpatch API that allows remote code execution by causing the installation of a Git hook. An attacker can submit a crafted request through the diffpatch API to plant a Git hook, which then executes arbitrary shell commands on the server when Git operations run; the CVSS vector indicates the attack requires no authentication or user interaction, while public reporting describes attackers with repository write access planting hooks to run shell commands. Successful exploitation yields full server compromise (confidentiality, integrity, and availability all rated high), and observed attacks have reportedly dropped a cryptocurrency miner. All Gitea deployments running versions prior to 1.27.1 are affected, with internet-facing instances at greatest risk; public scans identified over 8,300 vulnerable Gitea servers. The flaw is actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-25, and EPSS estimates an 86.8% probability of exploitation within 30 days.
What to do: Upgrade Gitea to version 1.27.1 or later immediately; organizations subject to BOD 26-04 must apply the vendor mitigation or discontinue use of unpatched cloud-hosted instances. Until patched, limit internet exposure of Gitea servers and inspect repository hook directories for unauthorized or recently modified hooks that could serve as persistence. Check for signs of compromise, including unexpected processes or cryptocurrency-miner activity, since in-the-wold attacks reportedly deploy a miner.
| Product | Affected |
|---|---|
| Gitea | all versions before 1.27.1 |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
PRC-linked Red Heron exploits critical Gitea RCE CVE-2026-60004 to steal source code and deploy JITTERLY implant with SIXZUT LD_PRELOAD rootkit; victims span five countries.
A Chinese-linked actor exploited WordPress and Zyxel flaws, stealing government records from dozens of organizations.
GreyNoise tracks 'Red Heron' actor exploiting multiple vulnerabilities including novel ZyXEL CVE-2026-7273 and stealing 18,000+ government records.
Chinese-speaking Red Heron actors mass-exploit Gitea n-day RCE CVE-2026-60004 to steal source code, credentials, and pivot into victim networks.
Attackers are actively exploiting critical Gitea RCE CVE-2026-60004 via the diffpatch endpoint, prompting CISA KEV addition and at least one cryptomining compromise.
Red Heron exploited Gitea CVE-2026-60004 to steal repositories and deploy the JITTERLY backdoor and SIXZUT rootkit.
China-linked Red Heron exploited Gitea RCE CVE-2026-60004 to compromise 13 organizations across six countries, stealing source code.
CISA added actively exploited Gitea RCE CVE-2026-60004 (CVSS 9.8) to the KEV catalog as attackers deploy a cryptojacking dropper.
CISA added the actively exploited Gitea RCE flaw CVE-2026-60004 (CVSS 9.8) to its KEV catalog, with federal patching due by August 28, 2026.
Over 8,300 internet-facing Gitea servers are exposed to active exploitation of CVE-2026-60004, an authenticated code injection flaw enabling arbitrary code execution.
CVE-2026-60004 (CVSS 9.8) lets attackers with repository write access achieve RCE on self-hosted Gitea servers via malicious git hooks; fixed in 1.27.1.
CISA added CVE-2026-60004, an actively exploited RCE via diffpatch Git hook installation in Gitea, to the KEV catalog; users should upgrade past 1.27.1.
Gitea fixes CVE-2026-60004, a 9.8 RCE that lets repository writers turn malicious patches into Git hooks and run commands.
Help Net Security's weekly digest highlights 274 compromised Zimbra servers, Gitea and Citrix NetScaler KEV additions, a PaperCut zero-day, and a suspected Iran-linked power plant attack.
Today 369 readers · 400 views · 302 reads · all time 158K views