Over 8,300 Internet-exposed Gitea instances remain unpatched against a critical security vulnerability that is actively being exploited in remote code execution attacks. Cybersecurity watchdog Shadowserver identified the scale of exposure. The flaw affects Gitea, a self-hosted Git service widely used for source code management. Despite patches being available, thousands of servers remain unprotected. Active exploitation makes this a high-priority patching concern for organizations running Gitea instances. Administrators are urged to update their Gitea deployments immediately to mitigate risk of compromise.
CVE-2026-60004 is a code injection vulnerability in Gitea's diffpatch API endpoint. An authenticated attacker with repository write access can submit malicious patches via the diffpatch endpoint to install and execute a Git hook from repository-controlled content, resulting in arbitrary shell command execution with the privileges of the Gitea OS service account. By default, Gitea has open self-registration enabled, meaning an unauthenticated attacker can register an account, create a repository, and exploit the vulnerability without any prior credentials — effectively making this exploitable by unauthenticated users. As of August 27, 2026, Shadowserver identified 8,393 internet-exposed Gitea instances still vulnerable. Attackers have been observed deploying cryptocurrency mining malware on unpatched servers. A separate critical vulnerability (CVE-2026-20896) affecting the official Gitea Docker image was also exploited in July 2026, involving an authentication bypass flaw in instances with reverse proxy authentication headers enabled.
1. Upgrade Gitea to version 1.27.1 or later immediately, as this release patches CVE-2026-60004. 2. If upgrading is not immediately possible, disable open/public user self-registration to reduce the attack surface. 3. Restrict network exposure of Gitea instances; avoid exposing them directly to the internet where possible. 4. U.S. FCEB agencies were ordered by CISA to patch by August 28, 2026, per Binding Operational Directive (BOD) 26-04. 5. Monitor Gitea servers for signs of compromise including unauthorized accounts, new repositories, unexpected processes, or cryptocurrency mining activity. 6. Review and restrict access to the diffpatch API endpoint. 7. Audit repositories for unauthorized Git hooks. 8. Also patch the Gitea Docker image vulnerability (CVE-2026-20896) if reverse proxy authentication headers are in use.
Cryptocurrency mining malware deployed on unpatched Gitea servers
