Attackers are actively exploiting a critical-severity vulnerability in the Gitea self-hosted Git service, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA).
Like cloud-hosted GitHub or GitLab SaaS (Software as a Service) platforms, Gitea provides a full suite of DevOps tools, but it is designed to be used as a self-hosted software development platform.
Tracked as CVE-2026-60004 and reported by Salesforce security researcher Shai Rod, this code injection security flaw allows an authenticated user with repository write access to repositories hosted on vulnerable servers to execute arbitrary shell commands with the privileges of the Gitea service account by submitting malicious patches via the diffpatch API endpoint.
However, default-configured Gitea instances have self-registration enabled, allowing unauthenticated attackers to register an account, create a new repository, and trigger the vulnerability without prior credentials.
“Gitea’s diffpatch endpoint can be abused to install and execute a Git hook from repository-controlled content. An attacker with ordinary write access to a repository can execute arbitrary shell commands as the Gitea OS user,” Gitea’s security team explains.
“With default open registration, an unauthenticated visitor can obtain the required write access by registering an account and creating a repository.”
Gitea released version 1.27.1 on July 27 to address CVE-2026-60004 and advised users to upgrade their servers as soon as possible.
Cybersecurity watchdog Shadowserver now tracks nearly 5,000 Gitea instances exposed online. However, there is no information on how many are honeypots or have already been secured against CVE-2026-60004 attacks.
On Tuesday, CISA added the vulnerability to its KEV catalog and ordered U.S. Federal Civilian Executive Branch (FCEB) agencies to secure their servers within three days, by August 28, as mandated by Binding Operational Directive (BOD) 26-04.
While the cybersecurity agency didn’t share further details on the attacks targeting this flaw, the action was likely prompted by reports of active exploitation in the wild, in which attackers deployed cryptocurrency mining malware on unpatched Gitea servers.
“This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise,” it warned.
“While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities.”
In July, threat actors were also spotted exploiting a critical Gitea authentication bypass vulnerability (CVE-2026-20896) in attacks targeting Gitea instances with reverse proxy authentication headers, such as X-WEBAUTH-USER, enabled.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
CISA orders urgent patching of actively exploited Zimbra flaw
CISA orders feds to patch actively exploited TrueConf Server flaws
Critical RCE flaw in Windows IKE Extension now actively exploited
CISA: Microsoft SharePoint flaw now exploited in ransomware attacks
CISA warns of hackers exploiting Langflow, N-central, Apache Tomcat flaws
Microsoft Teams now lets admins block external bots from meetings
ToxicPanda Android malware uses VPN permissions to block Google Play
Hackers target WordPress sites in miniOrange auth bypass attacks
Protect yourself from data brokers, scammers, and the next data breach with digital identities.
See how AI is reshaping email attacks. Download the 2026 Kaseya Email Security Report.
Discover how least agency keeps your AI tools capable, controlled, and secure.
Discover why encryption and key management are critical for modern business.
Overdue a password health-check? Audit your Active Directory for free
Stay one step ahead of new threats in the new year. Join Huntress for the monthly Tradecraft Tuesday.
Terms of Use – Privacy Policy – Ethics Statement – Affiliate Disclosure
Read our posting guidelinese to learn what content is prohibited.
