Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner
CISA added actively exploited Gitea RCE CVE-2026-60004 (CVSS 9.8) to the KEV catalog as attackers deploy a cryptojacking dropper.
CVE-2026-60004 is a critical remote code execution flaw affecting Gitea versions 1.17 through 1.27.0, abused via the diffpatch endpoint to install a Git hook and execute shell commands as the Gitea OS user. Default open registration lets unauthenticated attackers obtain the required repository write access. CISA added the flaw to its Known Exploited Vulnerabilities catalog, giving federal agencies until August 28, 2026 to patch; version 1.27.1 fixes it. A developer reported their HOSTKEY-hosted VPS was exploited to run a miner-like dropper, driving CPU usage above 70% and killing competing processes.
- Attackers register an account, create a repository and send a malicious patch to the diffpatch endpoint to plant a Git hook.
- Dropper clears LD_PRELOAD, kills high-CPU processes, fetches an architecture-specific payload, then deletes it after execution.
- Exploitation succeeded on servers with open registration, email confirmation disabled and OpenID signup enabled; attack vector was HTTPS.
- Fix shipped in Gitea 1.27.1; researcher Shai rod reported the flaw in July 2026.
- CVEs
- CVE-2026-60004
- Products
- Gitea
- Malware
- cryptocurrency-miner dropper
- Countries
- USA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-60004 | Unauthenticated RCE in Gitea via diffpatch API Git Hook Injection | 9.8 | 24% | KEVPoC ×4 | KEV |
From the original article
3 min read at thehackernews.com
Ravie Lakshmanan Aug 26, 2026 Vulnerability / Cryptojacking The U. S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday warned of active exploitation efforts targeting a recently patched critical security flaw impacting Gitea.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.