Attackers are actively exploiting a critical-severity vulnerability in Gitea, a self-hosted Git service platform. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed the exploitation of this flaw in code injection attacks. The vulnerability allows attackers to inject malicious code into affected Gitea instances. CISA's involvement indicates the threat is considered significant and widespread. Organizations running self-hosted Gitea instances are urged to apply patches immediately. The flaw is classified as critical severity, suggesting a high potential for damage. Code injection vulnerabilities can lead to full system compromise, data theft, or further network infiltration. This incident highlights the risks associated with self-hosted source code management platforms.
CVE-2026-60004 is a critical code injection vulnerability in Gitea's diffpatch API endpoint. An authenticated user with repository write access can execute arbitrary shell commands with the privileges of the Gitea service account by submitting malicious patches via the diffpatch API endpoint. The vulnerability works by abusing the diffpatch endpoint to install and execute a Git hook from repository-controlled content. Because Gitea enables self-registration by default, unauthenticated attackers can register an account, create a repository, and trigger the vulnerability without prior credentials, effectively making it unauthenticated remote code execution in default configurations. Attackers have been observed exploiting this vulnerability to deploy cryptocurrency mining malware on unpatched servers. A separate critical authentication bypass vulnerability (CVE-2026-20896) was also exploited in July targeting Gitea instances with reverse proxy authentication headers (e.g., X-WEBAUTH-USER) enabled. Reported by Salesforce security researcher Shai Rod. Approximately 5,000 Gitea instances are exposed online according to Shadowserver tracking.
1. Upgrade Gitea to version 1.27.1 or later immediately, as the patch was released on July 27. 2. U.S. Federal Civilian Executive Branch (FCEB) agencies must patch by August 28, 2026 per CISA BOD 26-04. 3. Disable open/self-registration on Gitea instances if not required to reduce attack surface for unauthenticated exploitation. 4. Disable or restrict reverse proxy authentication headers (e.g., X-WEBAUTH-USER) to mitigate CVE-2026-20896 exposure. 5. Monitor Gitea service account activity for unexpected shell command execution or new process spawning. 6. Review installed Git hooks in repositories for unauthorized or malicious entries. 7. Monitor for signs of cryptocurrency mining malware (high CPU usage, unexpected outbound network connections). 8. Restrict internet exposure of Gitea instances where possible, as nearly 5,000 are currently exposed online. 9. Follow CISA guidance and prioritize remediation of KEV Catalog vulnerabilities.
Cryptocurrency mining malware deployed on unpatched Gitea servers, Malicious patches submitted via the Gitea diffpatch API endpoint, Unexpected Git hooks installed in repositories, Unusual process execution by the Gitea OS service account
