CISA Issues Urgent Alert: Gitea Security Flaw Exploited
CISA has issued an alert regarding a recently addressed Gitea vulnerability that enables remote code execution and is currently being exploited in active cyberattacks.
CISA Alert on Gitea Vulnerability
CISA has issued an alert regarding a recently addressed Gitea vulnerability that enables remote code execution and is currently being exploited in active cyberattacks. Gitea, an open-source platform for software development, offers features such as Git hosting, code review, team collaboration, and continuous integration/continuous deployment (CI/CD) workflows. The specific flaw, designated as CVE-2026-60004, was resolved by Gitea developers in late July through the release of version 1.27.1. The agency has included the vulnerability in its Known Exploited Vulnerabilities (KEV) catalog and mandated that federal agencies apply the patch by August 28.
Vulnerability Details and Exploit Method
According to CISA, the vulnerability allows an attacker with repository write access to inject malicious code via the diffpatch API endpoint, enabling the deployment of an executable Git hook to execute shell commands under the Gitea service account. No prior evidence of exploitation for CVE-2026-60004 has been reported, and the identity of the threat actors and their objectives remain unknown.
Previous Gitea Vulnerabilities
This is not the first instance of Gitea vulnerabilities being exploited in recent months. In early July, another flaw, CVE-2026-20896, was linked to active attacks, though it has not yet been added to CISA’s KEV catalog. The ongoing exploitation of Gitea-related vulnerabilities underscores the importance of timely patching and proactive security measures for organizations using the platform.
About Author
English