Critical Gitea Vulnerability (CVE-2026-60004) Exploited in the Wild

Post Views: 4

Threat actors have initiated exploitation of CVE-2026-60004, a critical code injection flaw in the Gitea Git platform, as confirmed by CISA on Tuesday through its inclusion in the Known Exploited Vulnerabilities (KEV) catalog.

Overview of CVE-2026-60004

Gitea is an open-source Git platform built using the Go programming language, enabling users to host and manage repositories on private servers. The vulnerability, CVE-2026-60004, enables attackers to leverage the diffpatch endpoint to install and execute malicious Git hooks from repository-controlled content. Attackers with standard write access to a repository can execute arbitrary shell commands under the Gitea operating system user, as outlined by maintainers following the patch release in Gitea version 1.27.1. This flaw facilitates remote command execution under the Gitea service account.

Exploitation mechanics

The vulnerability becomes accessible to unauthenticated users when open registration is enabled. Although the flaw was privately disclosed to maintainers, a proof-of-concept exploit was included in the official advisory. Depending on deployment configurations and the privileges of the Gitea OS user, successful exploitation could expose critical system components such as the main configuration file, application secrets, database credentials, OAuth tokens, and integration keys.

Detection and incident analysis

A developer identified compromise through their hoster’s alert about prolonged high CPU usage on their virtual server. The server was running an outdated Gitea version with open user registration and no verification mechanisms, allowing an automated scanner to exploit the vulnerability. The attack executed code within the Gitea container as the git user, initially embedding a remote code execution (RCE) payload into a Git branch. Since Gitea operated in a Docker container, the malicious code persisted within the container environment. However, the container lacked privileged access, and the mining payload failed to survive restarts. No persistence mechanisms such as cron jobs, systemd services, or new SSH keys were detected during the investigation.

Mitigation and response

The developer resolved the issue by upgrading to Gitea version 1.27.2, disabling open registration, removing alternative signup methods, rotating all credentials, reinforcing Docker network settings, and restricting container outbound internet access. The active exploitation phase of the attack lasted approximately 11 seconds.

Recommendations for administrators

Gitea administrators are advised to update their instances to version 1.27.2 or later and conduct thorough security audits to confirm system integrity. CISA has mandated U.S. federal civilian agencies to implement this update by August 28, 2026.

Additional context

The incident highlights the risks associated with unpatched software and misconfigured deployment settings. Organizations using Gitea or similar platforms must prioritize timely updates and enforce strict access controls to mitigate exploitation risks.

“Threat actors have initiated exploitation of CVE-2026-60004, a critical code injection flaw in the Gitea Git platform, as confirmed by CISA on Tuesday through its inclusion in the Known Exploited Vulnerabilities (KEV) catalog.”

“An incident report from a self-described full-stack developer on the Russian collaborative blog Habr describes a successful compromise of their organization’s self-hosted Gitea instance using the vulnerability to deploy cryptocurrency mining software.”