The self-hosted Git platform Gitea is under active attack: on 25 August 2026 the US cyber agency CISA added the critical flaw CVE-2026-60004 to its Known Exploited Vulnerabilities (KEV) catalog and ordered federal agencies to patch by 28 August. According to Shadowserver, roughly 8,400 internet-facing Gitea servers were still vulnerable at the end of August.
Why the flaw is so dangerous
CVE-2026-60004 is a code-injection vulnerability (CWE-94) carrying the maximum CVSS score of 9.8. Through the diffpatch API endpoint, an attacker with write access to a repository can submit a crafted patch, plant an executable Git hook and run arbitrary shell commands with the privileges of the Gitea service account. The catch: default installations ship with open self-registration enabled, so an unauthenticated attacker can create their own account, spin up a repository and trigger the flaw without any prior access.
Exploitation in the wild
Security researchers report automated scanners compromising vulnerable instances within seconds and dropping a cryptocurrency-miner-like payload. Per CISA and Gitea, every release from version 1.17 onward is affected. The vendor closed the hole in Gitea 1.27.1 by creating the temporary repository used in patch operations as a non-bare clone.
What administrators should do now
- Update to Gitea 1.27.1 or later immediately.
- Disable open self-registration unless it is strictly required.
- Do not expose Gitea instances to the internet without protection; restrict access.
- Audit servers for unknown accounts, rogue repositories and suspicious Git hooks.
Sources: BleepingComputer, The Hacker News, SecurityWeek, Help Net Security, Gitea Blog.
