Vulnerability details
| CVE | CVSS | Affected versions | Fixed in | CISA KEV |
|---|---|---|---|---|
| CVE-2026-60004 | 9.8 | Gitea 1.17 to 1.27.0 | 1.27.1 | Added 25 August 2026 |
Gitea RCE through the diffpatch API
CVE-2026-60004 is a code injection flaw in Gitea's diffpatch API endpoint, which applies user-supplied patches. An attacker with ordinary write access to a repository can submit repository-controlled content that installs a Git hook, which then runs arbitrary shell commands as the Gitea service account during Git operations. runZero rates it critical with a CVSS score of 9.8 and lists Gitea 1.17 through 1.27.0 as affected.
Self-registration is enabled by default. Gitea's advisory, as quoted by Help Net Security and BleepingComputer, notes that with open registration an unauthenticated visitor can obtain the required write access by registering an account and creating a repository. Successful exploitation gives code execution with the privileges of the Gitea process, which runZero says could expose system secrets and credentials and affect downstream build pipelines.
The vulnerability was discovered and reported by security researcher Shai Rod (NightRang3r). Gitea released version 1.27.1 with the fix on 27 July 2026, followed by its security advisory on 28 July. Help Net Security notes that 1.27.2 was the latest release at the time of its report.
Active exploitation
CISA added CVE-2026-60004 to its Known Exploited Vulnerabilities catalogue on 25 August 2026 and gave US federal civilian agencies until 28 August to patch. CISA did not share details of the attacks.
Help Net Security reports that a self-described full-stack developer published an incident report on the Russian blog Habr after their hosting provider flagged high CPU usage on a virtual server running an outdated Gitea version with open registration. The attacker first wrote a proof of code execution into a Git branch, then downloaded a universal shell loader and a crypto-miner-like dropper. According to SOC Prime, the dropper tried to terminate competing CPU-heavy processes, downloaded a payload matching the host architecture, ran it and deleted the file. No persistence via cron, systemd or new SSH keys was found.
Exposure
BleepingComputer reported on 26 August that Shadowserver was tracking nearly 5,000 internet-exposed Gitea instances, with no information on how many were honeypots or already patched. CosmicBytez Labs later reported, citing Shadowserver, more than 8,300 exposed instances unpatched against CVE-2026-60004; we have not been able to confirm that figure against Shadowserver's own data.
Remediation
Upgrade to Gitea 1.27.1 or later; Help Net Security recommends the latest release. If open sign-up is not needed, disable self-registration, which removes the lowest-effort route to the write access the attack requires, and limit internet exposure of self-hosted instances.
A separate flaw, CVE-2026-59774, also affects Gitea. NVD describes it as a file read through the Org-mode renderer's INCLUDE directive that an unauthenticated attacker can trigger via a suitable public repository; if the disclosed files include app.ini and its INTERNAL_TOKEN, it can be chained to modify a Git hook and execute commands.
Key points
- CVE-2026-60004 lets a user with repository write access install a Git hook through Gitea's diffpatch API and run commands as the Gitea service account.
- Open self-registration, enabled by default, lets an unauthenticated visitor gain that write access.
- Gitea 1.17 through 1.27.0 are affected; 1.27.1, released 27 July 2026, fixes it.
- CISA added the flaw to KEV on 25 August 2026; reported attacks dropped miner-like payloads.
- Shadowserver tracked nearly 5,000 exposed Gitea instances in late August; a later figure of over 8,300 is unconfirmed.
Further reading & sources
- Gitea vulnerability CVE-2026-60004: find impacted assets — runZero
- Critical Gitea vulnerability now exploited in the wild (CVE-2026-60004) — Help Net Security
- Hackers now exploit critical Gitea flaw in code injection attacks — BleepingComputer
- CVE-2026-60004: Critical Gitea RCE Exploited to Deploy Miner-Like Payloads — SOC Prime
- Over 8,300 Gitea Servers Still Vulnerable to Active Code Execution Attacks — CosmicBytez Labs