Hackers now exploit critical Gitea flaw in code injection attacks

CVE-2026-60004 is a critical code injection vulnerability in Gitea, a self-hosted Git service. It enables attackers with write access to repositories to execute arbitrary shell commands as the Gitea OS user by submitting malicious patches through the diffpatch API endpoint. Because default Gitea instances allow self-registration, unauthenticated attackers can gain write access by registering an account and creating a repository, thereby triggering the vulnerability without prior credentials. The flaw was reported by a Salesforce security researcher and publicly disclosed with a patch in Gitea version 1.27.1 released on July 27, 2026. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its KEV catalog and mandated federal civilian agencies to patch within three days due to active exploitation reports, including deployment of cryptocurrency mining malware on vulnerable servers. Shadowserver tracks nearly 5,000 exposed Gitea instances online, though the number of vulnerable or secured instances is unknown.

The vulnerability allows arbitrary shell command execution with the privileges of the Gitea service account, enabling attackers to potentially take control of affected servers. Because default configurations permit self-registration, unauthenticated attackers can exploit the flaw without prior credentials. Active exploitation has been observed, including the deployment of cryptocurrency mining malware on unpatched Gitea servers. This poses a significant risk to the confidentiality, integrity, and availability of affected systems, especially in environments where Gitea is internet-exposed.

Gitea has released version 1.27.1 to fix CVE-2026-60004. Users should upgrade to this version or later as soon as possible. U.S. federal civilian agencies are mandated by CISA to patch within three days of the advisory. Organizations should verify if self-registration is enabled and consider disabling it to reduce risk. Since this is a self-hosted service, patching is the primary remediation. No vendor advisory states that no action is required or that the issue is already mitigated without patching.