Critical Gitea vulnerability now exploited in the wild (CVE-2026-60004)
Attackers are actively exploiting critical Gitea RCE CVE-2026-60004 via the diffpatch endpoint, prompting CISA KEV addition and at least one cryptomining compromise.
CISA added CVE-2026-60004, a critical code injection flaw in Gitea's diffpatch endpoint, to its Known Exploited Vulnerabilities catalog after in-the-wild attacks. An attacker with repository write access, or an unauthenticated visitor on instances with open registration, can execute arbitrary shell commands as the Gitea OS user. A disclosed incident saw an automated scanner register an account and deploy a loader and cryptominer inside a Docker container within about 11 seconds, with no persistence mechanism found. Gitea patched the flaw in v1.27.1, and CISA ordered US federal civilian agencies to update by August 28, 2026.
- CISA added CVE-2026-60004 to the KEV catalog, confirming in-the-wild exploitation.
- Flaw enables RCE as the Gitea service account via repository-controlled Git hooks.
- Instances with open registration are exploitable by unauthenticated users.
- Observed attack installed a cryptominer; no cron, systemd, or SSH persistence was found.
- Fixed in Gitea 1.27.2; federal patching deadline is August 28, 2026.
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-60004 | Unauthenticated RCE in Gitea via diffpatch API Git Hook Injection Gitea before 1.27.1 contains a critical code injection flaw (CWE-94) in the diffpatch API that allows remote code execution by causing the installation of a Git hook. An attacker can submit a crafted request through the diffpatch API to plant a Git hook, which then executes arbitrary shell commands on the server when Git operations run; the CVSS vector indicates the attack requires no authentication or user interaction, while public reporting describes attackers with repository write access planting hooks to run shell commands. Successful exploitation yields full server compromise (confidentiality, integrity, and availability all rated high), and observed attacks have reportedly dropped a cryptocurrency miner. All Gitea deployments running versions prior to 1.27.1 are affected, with internet-facing instances at greatest risk; public scans identified over 8,300 vulnerable Gitea servers. The flaw is actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-25, and EPSS estimates an 86.8% probability of exploitation within 30 days. Do: Upgrade Gitea to version 1.27.1 or later immediately; organizations subject to BOD 26-04 must apply the vendor mitigation or discontinue use of unpatched cloud-hosted instances. Until patched, limit internet exposure of Gitea servers and inspect repository hook directories for unauthorized or recently modified hooks that could serve as persistence. Check for signs of compromise, including unexpected processes or cryptocurrency-miner activity, since in-the-wold attacks reportedly deploy a miner. | 9.8 | 87% | KEV PoC ×4 |
| moderate≈8,300+ internet-exposed Gitea servers (public scan count) |
Full article506 words · extracted from helpnetsecurity.com · click to collapse
Attackers have begun exploiting CVE-2026-60004, a critical code injection vulnerability in the Gitea Git platform, CISA confirmed on Tuesday by adding the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog.
The KEV entry does not contain or point to details about the attacks, but according to an incident report published by a professed full-stack developer on the Russian collaborative blog Habr, someone has exploited the vulnerability to compromise their organization’s self-hosted Gitea instance and run crypto-mining software.
About CVE-2026-60004
Gitea is an open-source, Go-based Git platform that allows users to host and manage Git repositories on their own servers.
CVE-2026-60004 allows attackers to abuse Gitea’s diffpatch endpoint to install and execute a Git hook from repository-controlled content.
“An attacker with ordinary write access to a repository can execute arbitrary shell commands as the Gitea OS user,” the maintainers explained last month, after the vulnerability had been patched in Gitea v1.27.1.
“This is remote command execution as the Gitea service account. With open registration enabled, the attack can be performed by an unauthenticated visitor after registering a normal account and creating a repository.”
The vulnerability was privately disclosed to the maintainers, but the published advisory contained a PoC exploit.
Depending on deployment isolation and the privileges of the Gitea OS user, successful exploitation may expose Gitea’s main configuration file, application and process-environment secrets, database credentials and contents, and OAuth and integration credentials (among other things).
CVE-2026-60004 exploitation detected
The developer who discovered their Gitea instance had been compromised via CVE-2026-60004 was alerted by its hoster that their virtual server’s CPU had been running high for a long time.
Because the server ran an outdated version of Gitea, with open user registration and no email confirmation or CAPTCHA, an automated scanner was able to register an account, create its own repository, and trigger the exploit chain.
The attack executed code inside the Gitea container as the git user, first writing a “proof” of RCE back into a Git branch, then downloading a universal shell-loader and then a crypto-miner-like dropper that “fought” for CPU use.
“Gitea was running in Docker, so after the RCE the code ended up inside its container. The container wasn’t privileged, and after restarts the process with the miner-like payload didn’t survive the restart,” the developer noted.
“No traces of persistence via cron, systemd, or new SSH keys were found during the investigation.”
Once they discovered the extent of the compromise, the developer proceeded to upgrade Gitea to v1.27.2, disable open registration, remove extra signup methods, rotate all secrets and tokens, tighten Docker networking, and block outbound internet from the container.
According to the developer, the active part of the attack took about 11 seconds.
Gitea admins should upgrade their instances to a fixed version (1.27.2 is the latest one) and verify whether their server has been compromised.
CISA has ordered US federal civilian agencies to do it by August 28, 2026.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2026/08/26/gitea-cve-2026-60004-exploited-in-the-wild/