U.S. CISA adds Gitea flaw to its Known Exploited Vulnerabilities catalog
CISA added the actively exploited Gitea RCE flaw CVE-2026-60004 (CVSS 9.8) to its KEV catalog, with federal patching due by August 28, 2026.
CISA added CVE-2026-60004, a critical remote code execution flaw in Gitea (CVSS 9.8), to its Known Exploited Vulnerabilities catalog. The flaw affects Gitea versions since 1.17, fixed in 1.27.1, and lets attackers with repository write access execute shell commands via the diffpatch API and Git hooks. Open registration allows unauthenticated attackers to create accounts and exploit exposed instances, with a reported attack deploying a cryptocurrency-miner-like payload.
- CISA added Gitea CVE-2026-60004 (CVSS 9.8) to the KEV catalog with a fix deadline of August 28, 2026.
- Attackers with repository write access can run shell commands through the vulnerable diffpatch API and malicious Git hooks.
- Open registration lets unauthenticated attackers create an account and exploit exposed Gitea instances.
- A reported attack deployed a cryptocurrency-miner-like payload on an exposed Gitea server.
- Gitea 1.27.1 patches the flaw affecting versions from 1.17.
- CVEs
- CVE-2026-60004
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1059.004 Unix ShellT1546.018 Event Triggered Execution: Git Hooks
- Products
- Git
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-60004 | Unauthenticated RCE in Gitea via diffpatch API Git Hook Injection | 9.8 | 24% | KEVPoC ×4 | KEV |
From the original article
1 min read at securityaffairs.com
U. S. Cybersecurity and Infrastructure Security Agency (CISA) adds Gitea flaw to its Known Exploited Vulnerabilities catalog.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.