Critical Gitea vulnerability now exploited in the wild (CVE-2026-60004)
Attackers have begun exploiting CVE-2026-60004, a critical code injection vulnerability in the Gitea Git platform, CISA confirmed on Tuesday by adding the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog.
The KEV entry does not contain or point to details about the attacks, but according to an incident report published by a professed full-stack developer on the Russian collaborative blog Habr, someone has exploited the vulnerability to compromise their organization’s self-hosted Gitea instance and run crypto-mining software.
About CVE-2026-60004
Gitea is an open-source, Go-based Git platform that allows users to host and manage Git repositories on their own servers.
CVE-2026-60004 allows attackers to abuse Gitea’s diffpatch endpoint to install and execute a Git hook from repository-controlled content.
“An attacker with ordinary write access to a repository can execute arbitrary shell commands as the Gitea OS user,” the maintainers explained last month, after the vulnerability had been patched in Gitea v1.27.1.
“This is remote command execution as the Gitea service account. With open registration enabled, the attack can be performed by an unauthenticated visitor after registering a normal account and creating a repository.”
The vulnerability was privately disclosed to the maintainers, but the published advisory contained a PoC exploit.
Depending on deployment isolation and the privileges of the Gitea OS user, successful exploitation may expose Gitea’s main configuration file, application and process-environment secrets, database credentials and contents, and OAuth and integration credentials (among other things).
CVE-2026-60004 exploitation detected
The developer who discovered their Gitea instance had been compromised via CVE-2026-60004 was alerted by its hoster that their virtual server’s CPU had been running high for a long time.
Because the server ran an outdated version of Gitea, with open user registration and no email confirmation or CAPTCHA, an automated scanner was able to register an account, create its own repository, and trigger the exploit chain.
The attack executed code inside the Gitea container as the git user, first writing a “proof” of RCE back into a Git branch, then downloading a universal shell-loader and then a crypto-miner-like dropper that “fought” for CPU use.
“Gitea was running in Docker, so after the RCE the code ended up inside its container. The container wasn’t privileged, and after restarts the process with the miner-like payload didn’t survive the restart,” the developer noted.
“No traces of persistence via cron, systemd, or new SSH keys were found during the investigation.”
Once they discovered the extent of the compromise, the developer proceeded to upgrade Gitea to v1.27.2, disable open registration, remove extra signup methods, rotate all secrets and tokens, tighten Docker networking, and block outbound internet from the container.
According to the developer, the active part of the attack took about 11 seconds.
Gitea admins should upgrade their instances to a fixed version (1.27.2 is the latest one) and verify whether their server has been compromised.
CISA has ordered US federal civilian agencies to do it by August 28, 2026.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!