- The Mess: Attackers are actively exploiting a critical Gitea flaw that can turn repository write access into remote code execution. More than 8,300 Internet-exposed Gitea instances were still vulnerable when Shadowserver scanned the Internet, while CISA has already added CVE-2026-60004 to its Known Exploited Vulnerabilities catalog.
The vulnerability carries a CVSS score of 9.8 and affects Gitea versions from 1.17 up to, but not including, 1.27.1. Gitea fixed it in version 1.27.1.
The bug lives in Gitea’s diffpatch functionality.
An attacker with ordinary write access to a repository can abuse the patch-processing logic to install an executable Git hook inside the repository.
Once Git triggers that hook, the attacker can execute arbitrary shell commands with the privileges of the Gitea operating-system account.
That sounds like the attacker needs an existing account.
Sometimes they do.
But Gitea’s default open-registration configuration can make the situation considerably worse.
A visitor can register an account, create a repository and obtain the write access needed to reach the vulnerable functionality.
The attack therefore has a path from anonymous Internet visitor → Gitea account → repository → code execution on a vulnerable server.
- The Damage: A compromised Gitea server can expose source code, repository contents, application secrets, database credentials, OAuth tokens and other infrastructure secrets available to the Gitea process.
This is why a Git server compromise is rarely just a Git server compromise.
Development platforms often sit next to CI/CD systems and contain credentials that were never supposed to leave the build environment.
Gitea’s own security advisory warns that exploitation can expose app.ini, process environment secrets, mounted repositories, database credentials and OAuth or integration credentials.
And attackers are not merely testing the vulnerability.
CISA added CVE-2026-60004 to KEV on August 25 after evidence of exploitation in the wild. Separate incident reporting described attackers using the flaw to deploy cryptocurrency-mining malware on compromised Gitea systems.
One reported case is particularly ugly because the attack chain was short: the attacker registered a new Gitea account, created a project and used the vulnerability to install mining malware.
The server was not necessarily targeted because of some valuable repository.
It was simply an exposed machine running vulnerable software.
Shadowserver subsequently identified 8,393 vulnerable Gitea IP addresses during an Internet-wide scan.
- The Fix: Upgrade Gitea to 1.27.1 or later immediately, disable open registration if it is not required, restrict Internet access to the Git service and investigate vulnerable hosts for unauthorized accounts, repositories, Git hooks and mining processes.
Patching should come first.
Then investigate.
Administrators should look for unexpected accounts and repositories, particularly recently created ones. A newly registered user with a strange project name is worth investigating rather than deleting blindly.
Teams should also review the host for unexpected Git hooks and suspicious child processes launched by the Gitea service.
If the server contained CI/CD credentials, database passwords, cloud tokens or OAuth secrets while vulnerable, assume those credentials may have been exposed and rotate them.
The important point is that 1.27.1 is not optional for an exposed installation.
CISA’s KEV listing means the vulnerability has crossed the line from theoretical risk to confirmed exploitation.
Bugstoday Opinion
This is exactly why Internet-facing developer infrastructure deserves the same paranoia as VPN gateways and firewalls.
Gitea is supposed to hold code.
Instead, CVE-2026-60004 can turn it into an attacker’s shell.
The particularly nasty part is the registration path.
A server administrator can think:
“Users need accounts anyway.”
The attacker thinks:
“Great. I’ll make one.”
Then comes a repository, a malicious patch, a Git hook and arbitrary commands.
Meanwhile, thousands of Gitea installations are still sitting on the public Internet.
8,393 exposed systems is a very large target list.
If you’re running Gitea 1.27.0 or older, stop treating this as routine maintenance.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
Gitea — Remote Code Execution via diffpatch Git Hook Installation
CISA — Known Exploited Vulnerabilities Catalog
NVD — CVE-2026-60004
Shadowserver Foundation — Gitea Exposure Scanning
Gitea Security Advisory — CVE-2026-60004
