Hackers Target Critical Gitea Vulnerability in Code Injection Attacks

Post Views: 5

U.S. CISA warns of code injection attacks via CVE-2026-60004 in Gitea servers, urging immediate patching.

Cybercriminals Exploit Critical Gitea Vulnerability

Cybercriminals are leveraging a critical vulnerability in the Gitea self-hosted Git service to carry out code injection attacks, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA). The flaw, designated CVE-2026-60004, enables authenticated users with repository write access to execute arbitrary shell commands on vulnerable Gitea servers through the diffpatch API endpoint.

Understanding the Vulnerability

This capability allows adversaries to operate under the privileges of the Gitea service account. The vulnerability arises from the default configuration of Gitea instances, which often enable self-registration. This setup permits unauthenticated attackers to gain write access to repositories by creating accounts, subsequently exploiting the diffpatch endpoint to install malicious Git hooks. These hooks can then execute arbitrary system commands under the Gitea operating system user context.

CISA’s Response and Recommendations

Gitea’s security team confirmed that the flaw remains active in unpatched environments, emphasizing the risk posed by open registration settings. A patch for CVE-2026-60004 was released on July 27 as part of Gitea version 1.27.1, with urgent recommendations for administrators to update their servers. Shadowserver, a cybersecurity monitoring organization, has identified nearly 5,000 Gitea instances exposed to the internet.

CISA escalated the issue by including the vulnerability in its Known Exploited Vulnerabilities (KEV) catalog, mandating U.S. federal civilian agencies to address the flaw within three days. This directive aligns with Binding Operational Directive (BOD) 26-04, which requires immediate remediation of critical vulnerabilities.

Broader Implications and Threats

While CISA did not disclose specific attack details, the action follows reports of malicious actors deploying cryptocurrency mining malware on unpatched Gitea servers. The agency warned that such vulnerabilities represent a common entry point for threat actors, posing severe risks to federal infrastructure. Although BOD 26-04 applies exclusively to federal agencies, CISA urged all organizations to prioritize KEV catalog vulnerabilities through risk-based management practices.

Previous Exploitations and Industry Insights

This incident follows earlier exploitation of a separate Gitea vulnerability, CVE-2026-20896, which allowed attackers to bypass authentication mechanisms using reverse proxy headers like X-WEBAUTH-USER. Once credentials were obtained, adversaries could perform actions with limited detection, as only 37% of their activities were blocked. The Blue Report 2026 highlights the effectiveness of defensive measures across 338 million simulations, underscoring the importance of proactive security strategies.

Conclusion

Organizations must act swiftly to address CVE-2026-60004 and other KEV catalog vulnerabilities. Securing misconfigured DevOps platforms like Gitea remains critical as threat actors continue to exploit weaknesses in open-source infrastructure.