Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner
CISA added actively exploited Gitea RCE CVE-2026-60004 (CVSS 9.8) to the KEV catalog as attackers deploy a cryptojacking dropper.
CVE-2026-60004 is a critical remote code execution flaw affecting Gitea versions 1.17 through 1.27.0, abused via the diffpatch endpoint to install a Git hook and execute shell commands as the Gitea OS user. Default open registration lets unauthenticated attackers obtain the required repository write access. CISA added the flaw to its Known Exploited Vulnerabilities catalog, giving federal agencies until August 28, 2026 to patch; version 1.27.1 fixes it. A developer reported their HOSTKEY-hosted VPS was exploited to run a miner-like dropper, driving CPU usage above 70% and killing competing processes.
- Attackers register an account, create a repository and send a malicious patch to the diffpatch endpoint to plant a Git hook.
- Dropper clears LD_PRELOAD, kills high-CPU processes, fetches an architecture-specific payload, then deletes it after execution.
- Exploitation succeeded on servers with open registration, email confirmation disabled and OpenID signup enabled; attack vector was HTTPS.
- Fix shipped in Gitea 1.27.1; researcher Shai rod reported the flaw in July 2026.
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-60004 | Unauthenticated RCE in Gitea via diffpatch API Git Hook Injection Gitea before 1.27.1 contains a critical code injection flaw (CWE-94) in the diffpatch API that allows remote code execution by causing the installation of a Git hook. An attacker can submit a crafted request through the diffpatch API to plant a Git hook, which then executes arbitrary shell commands on the server when Git operations run; the CVSS vector indicates the attack requires no authentication or user interaction, while public reporting describes attackers with repository write access planting hooks to run shell commands. Successful exploitation yields full server compromise (confidentiality, integrity, and availability all rated high), and observed attacks have reportedly dropped a cryptocurrency miner. All Gitea deployments running versions prior to 1.27.1 are affected, with internet-facing instances at greatest risk; public scans identified over 8,300 vulnerable Gitea servers. The flaw is actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-25, and EPSS estimates an 86.8% probability of exploitation within 30 days. Do: Upgrade Gitea to version 1.27.1 or later immediately; organizations subject to BOD 26-04 must apply the vendor mitigation or discontinue use of unpatched cloud-hosted instances. Until patched, limit internet exposure of Gitea servers and inspect repository hook directories for unauthorized or recently modified hooks that could serve as persistence. Check for signs of compromise, including unexpected processes or cryptocurrency-miner activity, since in-the-wold attacks reportedly deploy a miner. | 9.8 | 87% | KEV PoC ×4 |
| moderate≈8,300+ internet-exposed Gitea servers (public scan count) |
Full article679 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananAug 26, 2026Vulnerability / Cryptojacking
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday warned of active exploitation efforts targeting a recently patched critical security flaw impacting Gitea.
The vulnerability in question is CVE-2026-60004 (CVSS score: 9.8), a case of remote code execution that allows an attacker with ordinary write access to a repository to execute arbitrary shell commands as the Gitea OS user.
"Gitea's diffpatch endpoint can be abused to install and execute a Git hook from repository-controlled content," according to an advisory released by Gitea last month. "With default open registration, an unauthenticated visitor can obtain the required write access by registering an account and creating a repository."
Security researcher Shai rod (aka NightRang3r) has been credited with discovering and reporting the issue. The issue affects all versions of Gitea from version 1.17 and has been patched in version 1.27.1.
As The Hacker News reported previously, while the vulnerable API call requires authentication and repository write permission, the fact that Gitea allows registration by default makes it possible for an external actor to create an account and a repository and then trigger the exploit without having to rely on pre-existing credentials.
"Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account," CISA said.
The agency, which added the flaw to its Known Exploited Vulnerabilities (KEV) catalog, did not disclose any details of how the security flaw has been exploited in the wild or who is behind the efforts.
However, a full-stack developer named Andrey (aka @Causelof) pointed out in an analysis published last week on the Russian blogging platform Habr that their Gitea instance was targeted by an unknown threat actor using CVE-2026-60004 to deploy a cryptocurrency-miner-like dropper.
The incident came to light after receiving an email notification from hosting provider HOSTKEY, stating their virtual server had been using more than 70% of the processor capacity for an extended period of time in violation of the service's terms, causing the provider to temporarily limit the available CPU resources to the VPS.
Specifically, the user cited the following configuration as responsible for driving the activity -
- DISABLE_REGISTRATION = false (If the parameter is enabled, only an admin can create accounts for users)
- REGISTER_EMAIL_CONFIRM = false (If the parameter is enabled, it asks for registration confirmation via email)
- ENABLE_OPENID_SIGNUP = true (The parameter allows registering via OpenID)
- REQUIRE_SIGNIN_VIEW = false (If the parameter is enabled, it forces users to log in to view any page or to use API)
"The fact that open registration is enabled here is significant precisely because of its connection to the vulnerability," Andrey noted. "A new user could register, create their own repository, and obtain the necessary write permissions within it. Gitea's SSH was not exposed to the outside world. The attack vector was via HTTPS."
Before deploying the miner-like payload, the dropper script is said to have undertaken the following steps -
- Clear LD_PRELOAD and LD_LIBRARY_PATH
- Search for processes with high CPU usage
- Attempt to kill competing processes
- Fetch the payload based on the system architecture
- Download, write it to a location on disk, and run it
- Delete the file after execution
The exact nature of the next-stage payload is unknown, as the developer said they did not conduct an analysis of its contents, adding "I do not have confirmed information regarding the mining pool, wallet, miner family, or specific operator." However, the spike in CPU usage lines up with a cryptojacking campaign targeting vulnerable Gitea instances.
It's unclear if CISA added the flaw to the KEV catalog because of this specific attack, or if it has uncovered evidence of exploitation targeting unpatched Gitea servers in the U.S. Federal agencies are required to patch the flaw by August 28, 2026, while prioritizing updates based on a risk-based approach.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/08/critical-gitea-rce-actively-exploited.html