Gitea, the open-source Git self-hosted platform, is facing an active remote code execution (RCE) exploit affecting versions 1.17 up to 1.27.0. The vulnerability—CVE-2026-60004—carries a near-maximum CVSS score of 9.8 and permits an attacker to run arbitrary shell commands as the Gitea OS user with nothing more than write access to a repository. The flaw pivots on abuse of the diffpatch API endpoint, which can be misused to install a malicious Git hook from content that the repository controls. Default settings where open registration is enabled allow an unauthenticated user to register, create a repository, and gain the write permissions needed to exploit the vulnerability.
How the Attack Manifests
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities catalog, although it hasn’t disclosed specifics about ongoing exploitation campaigns. Meanwhile, independent reports show that actors are deploying a dropper script that ushers in a miner-style payload. A Russian developer detailed how their Gitea instance was targeted: a newly registered account created a repo, submitted a crafted patch via diffpatch to insert a Git hook, and then executed shell commands to install the dropper.
In that incident, the script first stripped environment variables like LD_PRELOAD and LD_LIBRARY_PATH, scanned for high CPU processes and terminated them, pulled in the appropriate payload for the system’s architecture, wrote it to disk, executed it, and then deleted the binary. The payload itself resembles cryptocurrency‐mining software, though the victim couldn’t confirm the mining pool, operator identity, or miner family involved.
Conditions That Enable the Exploit
The threat hinges on specific configuration settings. Open registration must be allowed (DISABLE_REGISTRATION = false), email confirmation for registration must be off, open-ID signup enabled, and anonymous viewing of pages or API (REQUIRE_SIGNIN_VIEW = false). When those are in place, an attacker can bypass typical gatekeeping. HTTPS access is sufficient; SSH isn’t necessary.
Gitea has since patched the bug in version 1.27.1. Organizations still running earlier versions are urged to upgrade immediately. CISA has mandated that U.S. federal agencies complete patches by August 28, 2026, and urged all affected entities to adopt a risk-based approach when prioritizing remediation.
What This Means and What to Watch
This isn’t just another Git server vuln—it highlights how defaults that prioritize accessibility over security can backfire. Platforms like Gitea aim to be easy to onboard for teams but may inadvertently enable attackers to exploit weak configurations. Any org using self-hosted Git tooling especially with open registration needs to audit their setup for these settings, update to the fixed version, and monitor for unexpected behavior like high CPU usage or processes spawned without clear cause. One zero-day can ripple fast.
