A critical vulnerability in Gitea, a self-hosted Git service, is now being actively exploited by attackers, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA). The flaw, tracked as CVE-2026-60004, is a code injection vulnerability that allows an authenticated user with repository write access to execute arbitrary shell commands on affected servers.
The vulnerability was reported by Salesforce security researcher Shai Rod. It enables an attacker to submit malicious patches via the `diffpatch` API endpoint, leading to the execution of commands with the privileges of the Gitea service account. Gitea's security team confirmed that the `diffpatch` endpoint can be abused to install and execute a Git hook from repository-controlled content.
A significant concern is that Gitea instances often have self-registration enabled by default. This configuration allows unauthenticated attackers to register an account, create a new repository, and then exploit the vulnerability without needing prior credentials. This effectively lowers the barrier for entry for malicious actors.
Gitea released version 1.27.1 on July 27 to address CVE-2026-60004 and urged users to upgrade their servers promptly. Despite the patch availability, the cybersecurity watchdog Shadowserver is currently tracking nearly 5,000 Gitea instances exposed online, though it is unclear how many of these have been secured or are honeypots.
CISA added CVE-2026-60004 to its Known Exploited Vulnerabilities (KEV) catalog on August 26. The agency subsequently issued a directive to U.S. Federal Civilian Executive Branch (FCEB) agencies, mandating that they secure their Gitea servers by August 28, in accordance with Binding Operational Directive (BOD) 26-04. CISA emphasized that this type of vulnerability is a frequent attack vector and poses significant risks.
While CISA did not provide specific details on the ongoing attacks, the inclusion of the vulnerability in the KEV catalog and the urgent directive suggest active exploitation in the wild. Reports indicate that attackers have been deploying cryptocurrency mining malware on unpatched Gitea servers.
This incident follows another critical Gitea vulnerability, CVE-2026-20896, an authentication bypass flaw that was exploited in July. That vulnerability affected Gitea instances configured with reverse proxy authentication headers, such as X-WEBAUTH-USER, enabled.
