CVE-2026-73802 is a critical privilege management vulnerability in Gitea Runner that allows workflow authors to pass Docker container options preserving host namespaces and capabilities even when privileged mode is disabled. This enables execution of commands as root on the runner host by entering host PID/IPC namespaces. The flaw affects versions prior to 1.0.9-0.20260731160927-34bfa1915022 and is particularly dangerous for shared runners where untrusted users can submit workflows. A fix is available that rejects or strips unsafe container options when privileged mode is disabled.
A Chinese-speaking threat actor tracked as Red Heron rapidly weaponized CVE-2026-60004, a critical Gitea remote code execution vulnerability, within days of public disclosure in July 2026. The actor scanned 1,386 Gitea instances across seven countries, successfully compromising organizations in Canada, Argentina, Taiwan, the United States, and Sri Lanka. Activities included source code theft, credential collection, SSH persistence, and lateral movement, with one case escalating from a vulnerable Gitea server to root access across a three-node Proxmox cluster. An exposed staging server revealed targeting taxonomies using Simplified Chinese labels covering defense, elections, energy, aerospace, telecommunications, and government sectors. The campaign deployed JITTERLY, a C++ Linux implant with 30+ post-exploitation commands, embedding SIXZUT, a previously undocumented LD_PRELOAD rootkit capable of hiding files, processes, and network connections while protecting the implant from termination.
CVE-2026-24059 is a vulnerability in Gitea Open Source Git Server where a GET API endpoint that should be read-only actually creates a new runner registration token if none exists. This occurs because the API scope middleware incorrectly treats the GET request as read-only. An attacker with a leaked read:user-scoped token can exploit this to generate a registration token and register a malicious Actions runner, which can then execute workflow jobs with access to repository secrets and source code.
CVE-2026-58508 is a critical security vulnerability in the Gitea Open Source Git Server involving two server-side request forgery (SSRF) issues in the migration/mirror functionality. These SSRF vulnerabilities stem from DNS rebinding and missing re-validation mechanisms, potentially allowing an attacker to cause unauthorized requests from the server. The vulnerability has a CVSS score of 9.1, indicating high impact on confidentiality and integrity without requiring privileges or user interaction.
CVE-2026-58433 is a critical vulnerability in the Gitea Open Source Git Server where the team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting. This flaw allows unauthorized changes to team access settings on repositories, potentially leading to unauthorized access or privilege escalation. The vulnerability has a high CVSS score of 9.1, indicating severe impact on confidentiality and integrity without requiring privileges or user interaction.
CVE-2026-55986 is a medium severity vulnerability in the Gitea Open Source Git Server involving the Email Management API bypassing ManageCredentials feature restrictions. This could allow users with limited privileges to perform actions that should be restricted by the ManageCredentials feature. The vulnerability has a CVSS score of 5.4, indicating a moderate impact on confidentiality and integrity without affecting availability. No patch or official remediation guidance is currently available, and no known exploits are reported in the wild.
Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)
Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea
