Critical Gitea Vulnerabilities Allow Attackers to Bypass Authentication and Execute Code
Gitea 28.0.0 patches 20 flaws, including SSH impersonation, workflow approval bypasses, and SSRF.
66
- Mentions · 7d0
- Mentions · 30d2
- All mentions13
- First seenAug 25, 2026
- Last mentioned22d ago
Timeline
13 articles · newest firstGitea Patches 27 Security Flaws, Including Critical SSH Authentication Bypass and SSRF
Gitea 28.0.0 and 28.1.0 patch 27 flaws, including a CVSS 9.1 SSH authentication bypass.
73
Gitea 28.0
Gitea 28.0 adds audit logs and bot accounts, withholding security-fix details for about a week.
52
Red Heron Exploits Critical Gitea Flaw to Steal Repositories and Deploy Linux Rootkit
Red Heron exploited Gitea CVE-2026-60004 to steal repositories and deploy the JITTERLY backdoor and SIXZUT rootkit.
78
Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation
GreyNoise tracks 'Red Heron' actor exploiting multiple vulnerabilities including novel ZyXEL CVE-2026-7273 and stealing 18,000+ government records.
80
Bulk AbuseIPDB reporting using command-line tools
A blogger shows how to bulk-report distributed botnet IPs scraping a self-hosted Gitea instance to AbuseIPDB using bash, awk, and jq.
12
Emerging Threat: (CVE-2026-60004) Gitea Remote Code Execution via ...
CVE-2026-60004 (CVSS 9.8) lets attackers with repository write access achieve RCE on self-hosted Gitea servers via malicious git hooks; fixed in 1.27.1.
55
Week in review: Compromised Zimbra servers, previously patched Citrix NetScaler flaw exploited
Help Net Security's weekly digest highlights 274 compromised Zimbra servers, Gitea and Citrix NetScaler KEV additions, a PaperCut zero-day, and a suspected Iran-linked power plant attack.
25
Over 8,300 Gitea servers vulnerable to code execution attacks
Over 8,300 internet-facing Gitea servers are exposed to active exploitation of CVE-2026-60004, an authenticated code injection flaw enabling arbitrary code execution.
72
U.S. CISA adds Gitea flaw to its Known Exploited Vulnerabilities catalog
CISA added the actively exploited Gitea RCE flaw CVE-2026-60004 (CVSS 9.8) to its KEV catalog, with federal patching due by August 28, 2026.
74
Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner
CISA added actively exploited Gitea RCE CVE-2026-60004 (CVSS 9.8) to the KEV catalog as attackers deploy a cryptojacking dropper.
78
Critical Gitea vulnerability now exploited in the wild (CVE-2026-60004)
Attackers are actively exploiting critical Gitea RCE CVE-2026-60004 via the diffpatch endpoint, prompting CISA KEV addition and at least one cryptomining compromise.
80
Gitea security advisory (AV26-845)
CISA added CVE-2026-60004, an actively exploited RCE via diffpatch Git hook installation in Gitea, to the KEV catalog; users should upgrade past 1.27.1.
55
Related CVEs
by mentions- CVE-2026-6000424%9.8Unauthenticated RCE in Gitea via diffpatch API Git Hook Injection
- CVE-2026-94205<1%9.8Unapproved fork workflow execution in Gitea Actions
- Case-insensitive SSH key authentication bypass in Gitea
- Gitea Actions rerun bypasses fork-PR approval
- Migration allowlist DNS bypass to internal services in Gitea
- DNS rebinding SSRF in Gitea repository migration
- CVE-2026-101029<1%4.3DNS multi-answer SSRF bypass in Gitea migrations
- CVE-2026-56271<1%9.3Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets ('auth_token', 'refresh_token') and default audience and…
- CVE-2026-797565%8.7Unauthenticated OS Command Injection in Nuclio Dashboard (Local/Docker Platform)
- Gitea push-mirror TOCTOU bypasses migration address filters
Appears with
- Giteaproduct · 11
- Giteaorganization · 5
- CISAorganization · 4
- WordPressproduct · 2
- Gitea Actionsproduct · 2
- CISAvendor · 2
- Red Heronthreat actor · 2
- PaperCut MFproduct · 1
- FBIorganization · 1
- Acronisorganization · 1
- Red Heronmalware · 1
- Kasperskyvendor · 1
- Traefikproduct · 1
- Boston Scientificvictim · 1
- cryptocurrency-miner droppermalware · 1
- Western governmentvictim · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.